From 94c1569e53f1cdf454f448c7238c454f7c11bbdb Mon Sep 17 00:00:00 2001 From: delphij Date: Wed, 28 Sep 2016 06:11:01 +0000 Subject: [PATCH] MFV r306384: BIND 9.9.9-P3. git-svn-id: svn://svn.freebsd.org/base/stable/9@306394 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- contrib/bind9/CHANGES | 319 +- contrib/bind9/FAQ | 8 +- contrib/bind9/FAQ.xml | 158 +- contrib/bind9/Makefile.in | 7 +- contrib/bind9/README | 38 +- contrib/bind9/acconfig.h | 5 +- contrib/bind9/bin/check/Makefile.in | 4 +- contrib/bind9/bin/check/named-checkconf.8 | 92 +- contrib/bind9/bin/check/named-checkconf.c | 41 +- .../bind9/bin/check/named-checkconf.docbook | 72 +- contrib/bind9/bin/check/named-checkconf.html | 48 +- contrib/bind9/bin/check/named-checkzone.8 | 174 +- contrib/bind9/bin/check/named-checkzone.c | 2 +- .../bind9/bin/check/named-checkzone.docbook | 157 +- contrib/bind9/bin/check/named-checkzone.html | 162 +- contrib/bind9/bin/confgen/Makefile.in | 8 +- contrib/bind9/bin/confgen/ddns-confgen.8 | 104 +- .../bind9/bin/confgen/ddns-confgen.docbook | 67 +- contrib/bind9/bin/confgen/ddns-confgen.html | 56 +- contrib/bind9/bin/confgen/rndc-confgen.8 | 122 +- .../bind9/bin/confgen/rndc-confgen.docbook | 73 +- contrib/bind9/bin/confgen/rndc-confgen.html | 90 +- contrib/bind9/bin/dig/Makefile.in | 4 +- contrib/bind9/bin/dig/dig.1 | 347 +- contrib/bind9/bin/dig/dig.c | 41 +- contrib/bind9/bin/dig/dig.docbook | 120 +- contrib/bind9/bin/dig/dig.html | 123 +- contrib/bind9/bin/dig/dighost.c | 4 +- contrib/bind9/bin/dig/host.1 | 132 +- contrib/bind9/bin/dig/host.docbook | 80 +- contrib/bind9/bin/dig/host.html | 71 +- contrib/bind9/bin/dig/nslookup.1 | 129 +- contrib/bind9/bin/dig/nslookup.docbook | 77 +- contrib/bind9/bin/dig/nslookup.html | 62 +- contrib/bind9/bin/dnssec/Makefile.in | 6 +- contrib/bind9/bin/dnssec/dnssec-dsfromkey.8 | 110 +- .../bind9/bin/dnssec/dnssec-dsfromkey.docbook | 114 +- .../bind9/bin/dnssec/dnssec-dsfromkey.html | 42 +- contrib/bind9/bin/dnssec/dnssec-importkey.8 | 90 +- .../bind9/bin/dnssec/dnssec-importkey.docbook | 99 +- .../bind9/bin/dnssec/dnssec-importkey.html | 45 +- .../bind9/bin/dnssec/dnssec-keyfromlabel.8 | 196 +- .../bin/dnssec/dnssec-keyfromlabel.docbook | 111 +- .../bind9/bin/dnssec/dnssec-keyfromlabel.html | 58 +- contrib/bind9/bin/dnssec/dnssec-keygen.8 | 242 +- .../bind9/bin/dnssec/dnssec-keygen.docbook | 126 +- contrib/bind9/bin/dnssec/dnssec-keygen.html | 62 +- contrib/bind9/bin/dnssec/dnssec-revoke.8 | 63 +- contrib/bind9/bin/dnssec/dnssec-revoke.c | 3 +- .../bind9/bin/dnssec/dnssec-revoke.docbook | 65 +- contrib/bind9/bin/dnssec/dnssec-revoke.html | 30 +- contrib/bind9/bin/dnssec/dnssec-settime.8 | 102 +- contrib/bind9/bin/dnssec/dnssec-settime.c | 3 +- .../bind9/bin/dnssec/dnssec-settime.docbook | 92 +- contrib/bind9/bin/dnssec/dnssec-settime.html | 52 +- contrib/bind9/bin/dnssec/dnssec-signzone.8 | 282 +- contrib/bind9/bin/dnssec/dnssec-signzone.c | 16 +- .../bind9/bin/dnssec/dnssec-signzone.docbook | 135 +- contrib/bind9/bin/dnssec/dnssec-signzone.html | 102 +- contrib/bind9/bin/dnssec/dnssec-verify.8 | 76 +- .../bind9/bin/dnssec/dnssec-verify.docbook | 65 +- contrib/bind9/bin/dnssec/dnssec-verify.html | 36 +- contrib/bind9/bin/named/Makefile.in | 4 +- contrib/bind9/bin/named/client.c | 12 +- contrib/bind9/bin/named/config.c | 6 +- contrib/bind9/bin/named/control.c | 107 +- contrib/bind9/bin/named/controlconf.c | 6 +- contrib/bind9/bin/named/include/named/log.h | 4 +- contrib/bind9/bin/named/include/named/query.h | 3 +- .../bind9/bin/named/include/named/server.h | 43 +- contrib/bind9/bin/named/lwdgrbn.c | 20 +- contrib/bind9/bin/named/lwresd.8 | 150 +- contrib/bind9/bin/named/lwresd.docbook | 89 +- contrib/bind9/bin/named/lwresd.html | 52 +- contrib/bind9/bin/named/main.c | 30 +- contrib/bind9/bin/named/named.8 | 227 +- contrib/bind9/bin/named/named.conf.5 | 245 +- contrib/bind9/bin/named/named.conf.docbook | 143 +- contrib/bind9/bin/named/named.conf.html | 89 +- contrib/bind9/bin/named/named.docbook | 107 +- contrib/bind9/bin/named/named.html | 75 +- contrib/bind9/bin/named/query.c | 166 +- contrib/bind9/bin/named/server.c | 346 +- contrib/bind9/bin/named/statschannel.c | 8 +- .../bind9/bin/named/unix/include/named/os.h | 7 +- contrib/bind9/bin/named/unix/os.c | 37 +- contrib/bind9/bin/named/xfrout.c | 14 +- contrib/bind9/bin/nsupdate/Makefile.in | 4 +- contrib/bind9/bin/nsupdate/nsupdate.1 | 274 +- contrib/bind9/bin/nsupdate/nsupdate.c | 34 +- contrib/bind9/bin/nsupdate/nsupdate.docbook | 152 +- contrib/bind9/bin/nsupdate/nsupdate.html | 125 +- contrib/bind9/bin/rndc/Makefile.in | 4 +- contrib/bind9/bin/rndc/rndc.8 | 247 +- contrib/bind9/bin/rndc/rndc.conf.5 | 131 +- contrib/bind9/bin/rndc/rndc.conf.docbook | 53 +- contrib/bind9/bin/rndc/rndc.conf.html | 50 +- contrib/bind9/bin/rndc/rndc.docbook | 80 +- contrib/bind9/bin/rndc/rndc.html | 156 +- contrib/bind9/bin/tools/Makefile.in | 6 +- contrib/bind9/bin/tools/arpaname.1 | 40 +- contrib/bind9/bin/tools/arpaname.docbook | 42 +- contrib/bind9/bin/tools/arpaname.html | 22 +- contrib/bind9/bin/tools/genrandom.8 | 44 +- contrib/bind9/bin/tools/genrandom.docbook | 53 +- contrib/bind9/bin/tools/genrandom.html | 28 +- contrib/bind9/bin/tools/isc-hmac-fixup.8 | 52 +- .../bind9/bin/tools/isc-hmac-fixup.docbook | 51 +- contrib/bind9/bin/tools/isc-hmac-fixup.html | 30 +- contrib/bind9/bin/tools/named-journalprint.8 | 54 +- .../bin/tools/named-journalprint.docbook | 47 +- .../bind9/bin/tools/named-journalprint.html | 30 +- contrib/bind9/bin/tools/nsec3hash.8 | 48 +- contrib/bind9/bin/tools/nsec3hash.docbook | 55 +- contrib/bind9/bin/tools/nsec3hash.html | 28 +- contrib/bind9/config.h.in | 8 +- contrib/bind9/configure.in | 129 +- contrib/bind9/doc/Makefile.in | 6 +- contrib/bind9/doc/arm/Bv9ARM-book.xml | 3766 ++++++-------- contrib/bind9/doc/arm/Bv9ARM.ch01.html | 111 +- contrib/bind9/doc/arm/Bv9ARM.ch02.html | 51 +- contrib/bind9/doc/arm/Bv9ARM.ch03.html | 222 +- contrib/bind9/doc/arm/Bv9ARM.ch04.html | 1221 ++--- contrib/bind9/doc/arm/Bv9ARM.ch05.html | 39 +- contrib/bind9/doc/arm/Bv9ARM.ch06.html | 4573 +++++++++-------- contrib/bind9/doc/arm/Bv9ARM.ch07.html | 85 +- contrib/bind9/doc/arm/Bv9ARM.ch08.html | 43 +- contrib/bind9/doc/arm/Bv9ARM.ch09.html | 151 +- contrib/bind9/doc/arm/Bv9ARM.ch10.html | 192 +- contrib/bind9/doc/arm/Bv9ARM.ch11.html | 279 +- contrib/bind9/doc/arm/Bv9ARM.ch12.html | 231 +- contrib/bind9/doc/arm/Bv9ARM.ch13.html | 20 +- contrib/bind9/doc/arm/Bv9ARM.conf | 3 + contrib/bind9/doc/arm/Bv9ARM.html | 316 +- contrib/bind9/doc/arm/Bv9ARM.pdf | Bin 1361042 -> 1135210 bytes contrib/bind9/doc/arm/Makefile.in | 68 +- contrib/bind9/doc/arm/README-SGML | 342 +- contrib/bind9/doc/arm/dnssec.xml | 146 +- contrib/bind9/doc/arm/html-fixup.pl | 20 - contrib/bind9/doc/arm/libdns.xml | 193 +- contrib/bind9/doc/arm/logging-categories.xml | 378 ++ contrib/bind9/doc/arm/man.arpaname.html | 24 +- contrib/bind9/doc/arm/man.ddns-confgen.html | 58 +- contrib/bind9/doc/arm/man.dig.html | 127 +- contrib/bind9/doc/arm/man.dnssec-checkds.html | 38 +- .../bind9/doc/arm/man.dnssec-coverage.html | 36 +- .../bind9/doc/arm/man.dnssec-dsfromkey.html | 54 +- .../bind9/doc/arm/man.dnssec-importkey.html | 182 + .../doc/arm/man.dnssec-keyfromlabel.html | 68 +- contrib/bind9/doc/arm/man.dnssec-keygen.html | 66 +- contrib/bind9/doc/arm/man.dnssec-revoke.html | 32 +- contrib/bind9/doc/arm/man.dnssec-settime.html | 56 +- .../bind9/doc/arm/man.dnssec-signzone.html | 104 +- contrib/bind9/doc/arm/man.dnssec-verify.html | 38 +- contrib/bind9/doc/arm/man.genrandom.html | 30 +- contrib/bind9/doc/arm/man.host.html | 73 +- contrib/bind9/doc/arm/man.isc-hmac-fixup.html | 32 +- contrib/bind9/doc/arm/man.lwresd.html | 258 + .../bind9/doc/arm/man.named-checkconf.html | 50 +- .../bind9/doc/arm/man.named-checkzone.html | 164 +- .../bind9/doc/arm/man.named-journalprint.html | 40 +- contrib/bind9/doc/arm/man.named.conf.html | 677 +++ contrib/bind9/doc/arm/man.named.html | 87 +- contrib/bind9/doc/arm/man.nsec3hash.html | 30 +- contrib/bind9/doc/arm/man.nsupdate.html | 129 +- contrib/bind9/doc/arm/man.rndc-confgen.html | 92 +- contrib/bind9/doc/arm/man.rndc.conf.html | 52 +- contrib/bind9/doc/arm/man.rndc.html | 160 +- contrib/bind9/doc/arm/managed-keys.xml | 46 +- contrib/bind9/doc/arm/notes-wrapper.xml | 18 +- contrib/bind9/doc/arm/notes.conf | 3 + contrib/bind9/doc/arm/notes.html | 119 +- contrib/bind9/doc/arm/notes.pdf | Bin 65687 -> 43434 bytes contrib/bind9/doc/arm/notes.xml | 148 +- contrib/bind9/doc/arm/noteversion.xml.in | 17 + contrib/bind9/doc/arm/pkcs11.xml | 152 +- contrib/bind9/doc/arm/pkgversion.xml.in | 17 + contrib/bind9/doc/arm/releaseinfo.xml.in | 17 + contrib/bind9/doc/misc/options | 70 +- contrib/bind9/doc/misc/rfc-compliance | 2 +- contrib/bind9/isc-config.sh.in | 2 +- contrib/bind9/lib/bind9/Makefile.in | 4 +- contrib/bind9/lib/bind9/api | 2 +- contrib/bind9/lib/bind9/check.c | 34 +- .../bind9/lib/bind9/include/bind9/Makefile.in | 4 +- contrib/bind9/lib/dns/Makefile.in | 8 +- contrib/bind9/lib/dns/acache.c | 12 +- contrib/bind9/lib/dns/api | 6 +- contrib/bind9/lib/dns/cache.c | 16 +- contrib/bind9/lib/dns/client.c | 8 +- contrib/bind9/lib/dns/dst_api.c | 15 +- contrib/bind9/lib/dns/dst_openssl.h | 2 +- contrib/bind9/lib/dns/forward.c | 5 +- contrib/bind9/lib/dns/gen.c | 8 +- contrib/bind9/lib/dns/include/dns/Makefile.in | 4 +- .../bind9/lib/dns/include/dns/dbiterator.h | 6 +- contrib/bind9/lib/dns/include/dns/forward.h | 5 +- contrib/bind9/lib/dns/include/dns/message.h | 11 +- contrib/bind9/lib/dns/include/dns/name.h | 14 +- contrib/bind9/lib/dns/include/dns/rbt.h | 60 +- contrib/bind9/lib/dns/include/dns/view.h | 8 +- contrib/bind9/lib/dns/include/dst/Makefile.in | 4 +- contrib/bind9/lib/dns/journal.c | 9 +- contrib/bind9/lib/dns/master.c | 58 +- contrib/bind9/lib/dns/message.c | 127 +- contrib/bind9/lib/dns/name.c | 229 +- contrib/bind9/lib/dns/nsec3.c | 6 +- contrib/bind9/lib/dns/openssl_link.c | 23 +- contrib/bind9/lib/dns/openssldh_link.c | 6 +- contrib/bind9/lib/dns/openssldsa_link.c | 6 +- contrib/bind9/lib/dns/opensslrsa_link.c | 5 +- contrib/bind9/lib/dns/rbt.c | 428 +- contrib/bind9/lib/dns/rbtdb.c | 162 +- contrib/bind9/lib/dns/rcode.c | 12 +- contrib/bind9/lib/dns/rdata.c | 235 + .../bind9/lib/dns/rdata/any_255/tsig_250.c | 3 +- contrib/bind9/lib/dns/rdata/ch_3/a_1.c | 3 +- .../bind9/lib/dns/rdata/generic/afsdb_18.c | 3 +- contrib/bind9/lib/dns/rdata/generic/avc_258.c | 168 + contrib/bind9/lib/dns/rdata/generic/avc_258.h | 35 + contrib/bind9/lib/dns/rdata/generic/caa_257.c | 4 +- .../bind9/lib/dns/rdata/generic/cdnskey_60.c | 229 +- .../bind9/lib/dns/rdata/generic/cdnskey_60.h | 13 +- contrib/bind9/lib/dns/rdata/generic/cds_59.c | 202 +- contrib/bind9/lib/dns/rdata/generic/cds_59.h | 12 +- contrib/bind9/lib/dns/rdata/generic/cname_5.c | 3 +- .../bind9/lib/dns/rdata/generic/csync_62.c | 268 + .../bind9/lib/dns/rdata/generic/csync_62.h | 33 + .../bind9/lib/dns/rdata/generic/dlv_32769.c | 194 +- .../bind9/lib/dns/rdata/generic/dlv_32769.h | 12 +- .../bind9/lib/dns/rdata/generic/dname_39.c | 3 +- .../bind9/lib/dns/rdata/generic/dnskey_48.c | 231 +- .../bind9/lib/dns/rdata/generic/dnskey_48.h | 18 +- contrib/bind9/lib/dns/rdata/generic/ds_43.c | 79 +- contrib/bind9/lib/dns/rdata/generic/hip_55.c | 4 +- .../bind9/lib/dns/rdata/generic/ipseckey_45.c | 3 +- contrib/bind9/lib/dns/rdata/generic/key_25.c | 138 +- contrib/bind9/lib/dns/rdata/generic/key_25.h | 18 +- contrib/bind9/lib/dns/rdata/generic/lp_107.c | 3 +- contrib/bind9/lib/dns/rdata/generic/mb_7.c | 3 +- contrib/bind9/lib/dns/rdata/generic/md_3.c | 3 +- contrib/bind9/lib/dns/rdata/generic/mf_4.c | 3 +- contrib/bind9/lib/dns/rdata/generic/mg_8.c | 3 +- .../bind9/lib/dns/rdata/generic/minfo_14.c | 4 +- contrib/bind9/lib/dns/rdata/generic/mr_9.c | 3 +- contrib/bind9/lib/dns/rdata/generic/mx_15.c | 3 +- .../bind9/lib/dns/rdata/generic/naptr_35.c | 3 +- .../bind9/lib/dns/rdata/generic/ninfo_56.c | 196 + .../bind9/lib/dns/rdata/generic/ninfo_56.h | 39 + contrib/bind9/lib/dns/rdata/generic/ns_2.c | 3 +- .../bind9/lib/dns/rdata/generic/nsec3_50.c | 136 +- contrib/bind9/lib/dns/rdata/generic/nsec_47.c | 128 +- contrib/bind9/lib/dns/rdata/generic/nxt_30.c | 3 +- contrib/bind9/lib/dns/rdata/generic/ptr_12.c | 3 +- contrib/bind9/lib/dns/rdata/generic/rkey_57.c | 173 + contrib/bind9/lib/dns/rdata/generic/rkey_57.h | 22 + contrib/bind9/lib/dns/rdata/generic/rp_17.c | 3 +- .../bind9/lib/dns/rdata/generic/rrsig_46.c | 3 +- contrib/bind9/lib/dns/rdata/generic/rt_21.c | 3 +- contrib/bind9/lib/dns/rdata/generic/sig_24.c | 3 +- contrib/bind9/lib/dns/rdata/generic/sink_40.c | 283 + contrib/bind9/lib/dns/rdata/generic/sink_40.h | 30 + .../bind9/lib/dns/rdata/generic/smimea_53.c | 161 + .../bind9/lib/dns/rdata/generic/smimea_53.h | 22 + contrib/bind9/lib/dns/rdata/generic/soa_6.c | 3 +- contrib/bind9/lib/dns/rdata/generic/spf_99.c | 95 +- .../bind9/lib/dns/rdata/generic/ta_32768.c | 170 + .../bind9/lib/dns/rdata/generic/ta_32768.h | 25 + .../bind9/lib/dns/rdata/generic/talink_58.c | 269 + .../bind9/lib/dns/rdata/generic/talink_58.h | 29 + .../bind9/lib/dns/rdata/generic/tkey_249.c | 3 +- contrib/bind9/lib/dns/rdata/generic/tlsa_52.c | 80 +- contrib/bind9/lib/dns/rdata/generic/txt_16.c | 139 +- contrib/bind9/lib/dns/rdata/in_1/a6_38.c | 3 +- contrib/bind9/lib/dns/rdata/in_1/kx_36.c | 3 +- .../bind9/lib/dns/rdata/in_1/nsap-ptr_23.c | 3 +- contrib/bind9/lib/dns/rdata/in_1/px_26.c | 5 +- contrib/bind9/lib/dns/rdata/in_1/srv_33.c | 3 +- contrib/bind9/lib/dns/resolver.c | 103 +- contrib/bind9/lib/dns/rootns.c | 4 +- contrib/bind9/lib/dns/sdlz.c | 12 +- contrib/bind9/lib/dns/tkey.c | 9 +- contrib/bind9/lib/dns/update.c | 9 +- contrib/bind9/lib/dns/view.c | 19 +- contrib/bind9/lib/dns/xfrin.c | 19 +- contrib/bind9/lib/dns/zone.c | 73 +- contrib/bind9/lib/export/dns/Makefile.in | 9 +- .../lib/export/dns/include/dns/Makefile.in | 4 +- .../lib/export/dns/include/dst/Makefile.in | 4 +- contrib/bind9/lib/export/irs/Makefile.in | 4 +- .../lib/export/irs/include/irs/Makefile.in | 4 +- contrib/bind9/lib/export/isc/Makefile.in | 4 +- .../lib/export/isc/include/isc/Makefile.in | 4 +- .../isc/nothreads/include/isc/Makefile.in | 4 +- .../isc/pthreads/include/isc/Makefile.in | 4 +- .../export/isc/unix/include/isc/Makefile.in | 2 +- contrib/bind9/lib/export/isccfg/Makefile.in | 4 +- .../export/isccfg/include/isccfg/Makefile.in | 4 +- contrib/bind9/lib/export/samples/Makefile.in | 4 +- contrib/bind9/lib/irs/Makefile.in | 4 +- contrib/bind9/lib/irs/resconf.c | 5 +- contrib/bind9/lib/isc/Makefile.in | 4 +- .../lib/isc/alpha/include/isc/Makefile.in | 4 +- contrib/bind9/lib/isc/api | 6 +- contrib/bind9/lib/isc/base32.c | 4 +- contrib/bind9/lib/isc/base64.c | 4 +- contrib/bind9/lib/isc/buffer.c | 4 +- contrib/bind9/lib/isc/commandline.c | 2 +- contrib/bind9/lib/isc/hash.c | 151 +- contrib/bind9/lib/isc/hex.c | 4 +- contrib/bind9/lib/isc/httpd.c | 98 +- .../lib/isc/ia64/include/isc/Makefile.in | 4 +- contrib/bind9/lib/isc/include/isc/Makefile.in | 4 +- .../bind9/lib/isc/include/isc/assertions.h | 10 +- contrib/bind9/lib/isc/include/isc/error.h | 4 +- contrib/bind9/lib/isc/include/isc/file.h | 6 +- contrib/bind9/lib/isc/include/isc/hash.h | 41 +- contrib/bind9/lib/isc/include/isc/magic.h | 8 +- contrib/bind9/lib/isc/include/isc/netaddr.h | 8 +- .../bind9/lib/isc/include/isc/platform.h.in | 10 +- contrib/bind9/lib/isc/include/isc/result.h | 5 +- contrib/bind9/lib/isc/include/isc/sockaddr.h | 8 +- contrib/bind9/lib/isc/include/isc/socket.h | 6 +- contrib/bind9/lib/isc/include/isc/util.h | 13 +- contrib/bind9/lib/isc/md5.c | 4 +- contrib/bind9/lib/isc/mem.c | 58 +- .../lib/isc/mips/include/isc/Makefile.in | 4 +- contrib/bind9/lib/isc/netaddr.c | 18 +- .../lib/isc/noatomic/include/isc/Makefile.in | 4 +- .../lib/isc/nothreads/include/isc/Makefile.in | 4 +- .../lib/isc/powerpc/include/isc/Makefile.in | 4 +- .../lib/isc/pthreads/include/isc/Makefile.in | 4 +- contrib/bind9/lib/isc/result.c | 1 + contrib/bind9/lib/isc/sockaddr.c | 25 +- .../lib/isc/sparc64/include/isc/Makefile.in | 4 +- contrib/bind9/lib/isc/stats.c | 78 +- contrib/bind9/lib/isc/string.c | 6 +- contrib/bind9/lib/isc/task.c | 4 +- contrib/bind9/lib/isc/unix/file.c | 15 +- .../lib/isc/unix/include/isc/Makefile.in | 4 +- contrib/bind9/lib/isc/unix/net.c | 4 +- contrib/bind9/lib/isc/unix/socket.c | 94 +- .../lib/isc/x86_32/include/isc/Makefile.in | 4 +- .../bind9/lib/isc/x86_32/include/isc/atomic.h | 26 +- .../lib/isc/x86_64/include/isc/Makefile.in | 4 +- .../bind9/lib/isc/x86_64/include/isc/atomic.h | 33 +- contrib/bind9/lib/isccc/Makefile.in | 2 +- contrib/bind9/lib/isccc/cc.c | 41 +- .../bind9/lib/isccc/include/isccc/Makefile.in | 4 +- contrib/bind9/lib/isccc/sexpr.c | 56 +- contrib/bind9/lib/isccfg/Makefile.in | 4 +- contrib/bind9/lib/isccfg/aclconf.c | 9 +- contrib/bind9/lib/isccfg/api | 2 +- .../lib/isccfg/include/isccfg/Makefile.in | 4 +- contrib/bind9/lib/isccfg/namedconf.c | 119 +- contrib/bind9/lib/isccfg/parser.c | 9 +- contrib/bind9/lib/lwres/Makefile.in | 4 +- contrib/bind9/lib/lwres/man/Makefile.in | 4 +- contrib/bind9/lib/lwres/man/lwres.3 | 126 +- contrib/bind9/lib/lwres/man/lwres.docbook | 68 +- contrib/bind9/lib/lwres/man/lwres.html | 47 +- contrib/bind9/lib/lwres/man/lwres_buffer.3 | 174 +- .../bind9/lib/lwres/man/lwres_buffer.docbook | 37 +- contrib/bind9/lib/lwres/man/lwres_buffer.html | 187 +- contrib/bind9/lib/lwres/man/lwres_config.3 | 73 +- .../bind9/lib/lwres/man/lwres_config.docbook | 46 +- contrib/bind9/lib/lwres/man/lwres_config.html | 68 +- contrib/bind9/lib/lwres/man/lwres_context.3 | 110 +- .../bind9/lib/lwres/man/lwres_context.docbook | 42 +- .../bind9/lib/lwres/man/lwres_context.html | 118 +- contrib/bind9/lib/lwres/man/lwres_gabn.3 | 115 +- .../bind9/lib/lwres/man/lwres_gabn.docbook | 44 +- contrib/bind9/lib/lwres/man/lwres_gabn.html | 121 +- .../bind9/lib/lwres/man/lwres_gai_strerror.3 | 52 +- .../lib/lwres/man/lwres_gai_strerror.docbook | 34 +- .../lib/lwres/man/lwres_gai_strerror.html | 26 +- .../bind9/lib/lwres/man/lwres_getaddrinfo.3 | 111 +- .../lib/lwres/man/lwres_getaddrinfo.docbook | 42 +- .../lib/lwres/man/lwres_getaddrinfo.html | 49 +- .../bind9/lib/lwres/man/lwres_gethostent.3 | 153 +- .../lib/lwres/man/lwres_gethostent.docbook | 48 +- .../bind9/lib/lwres/man/lwres_gethostent.html | 170 +- contrib/bind9/lib/lwres/man/lwres_getipnode.3 | 101 +- .../lib/lwres/man/lwres_getipnode.docbook | 40 +- .../bind9/lib/lwres/man/lwres_getipnode.html | 72 +- .../bind9/lib/lwres/man/lwres_getnameinfo.3 | 77 +- .../lib/lwres/man/lwres_getnameinfo.docbook | 46 +- .../lib/lwres/man/lwres_getnameinfo.html | 58 +- .../lib/lwres/man/lwres_getrrsetbyname.3 | 75 +- .../lwres/man/lwres_getrrsetbyname.docbook | 44 +- .../lib/lwres/man/lwres_getrrsetbyname.html | 53 +- contrib/bind9/lib/lwres/man/lwres_gnba.3 | 112 +- .../bind9/lib/lwres/man/lwres_gnba.docbook | 44 +- contrib/bind9/lib/lwres/man/lwres_gnba.html | 121 +- contrib/bind9/lib/lwres/man/lwres_hstrerror.3 | 52 +- .../lib/lwres/man/lwres_hstrerror.docbook | 40 +- .../bind9/lib/lwres/man/lwres_hstrerror.html | 37 +- contrib/bind9/lib/lwres/man/lwres_inetntop.3 | 52 +- .../lib/lwres/man/lwres_inetntop.docbook | 42 +- .../bind9/lib/lwres/man/lwres_inetntop.html | 40 +- contrib/bind9/lib/lwres/man/lwres_noop.3 | 112 +- .../bind9/lib/lwres/man/lwres_noop.docbook | 42 +- contrib/bind9/lib/lwres/man/lwres_noop.html | 121 +- contrib/bind9/lib/lwres/man/lwres_packet.3 | 97 +- .../bind9/lib/lwres/man/lwres_packet.docbook | 34 +- contrib/bind9/lib/lwres/man/lwres_packet.html | 43 +- contrib/bind9/lib/lwres/man/lwres_resutil.3 | 102 +- .../bind9/lib/lwres/man/lwres_resutil.docbook | 40 +- .../bind9/lib/lwres/man/lwres_resutil.html | 89 +- contrib/bind9/make/rules.in | 4 +- contrib/bind9/version | 4 +- lib/bind/dns/code.h | 150 +- lib/bind/dns/dns/enumtype.h | 16 + lib/bind/dns/dns/rdatastruct.h | 308 +- share/doc/bind9/Makefile | 69 +- 415 files changed, 20250 insertions(+), 16126 deletions(-) create mode 100644 contrib/bind9/doc/arm/Bv9ARM.conf delete mode 100755 contrib/bind9/doc/arm/html-fixup.pl create mode 100644 contrib/bind9/doc/arm/logging-categories.xml create mode 100644 contrib/bind9/doc/arm/man.dnssec-importkey.html create mode 100644 contrib/bind9/doc/arm/man.lwresd.html create mode 100644 contrib/bind9/doc/arm/man.named.conf.html create mode 100644 contrib/bind9/doc/arm/notes.conf create mode 100644 contrib/bind9/doc/arm/noteversion.xml.in create mode 100644 contrib/bind9/doc/arm/pkgversion.xml.in create mode 100644 contrib/bind9/doc/arm/releaseinfo.xml.in create mode 100644 contrib/bind9/lib/dns/rdata/generic/avc_258.c create mode 100644 contrib/bind9/lib/dns/rdata/generic/avc_258.h create mode 100644 contrib/bind9/lib/dns/rdata/generic/csync_62.c create mode 100644 contrib/bind9/lib/dns/rdata/generic/csync_62.h create mode 100644 contrib/bind9/lib/dns/rdata/generic/ninfo_56.c create mode 100644 contrib/bind9/lib/dns/rdata/generic/ninfo_56.h create mode 100644 contrib/bind9/lib/dns/rdata/generic/rkey_57.c create mode 100644 contrib/bind9/lib/dns/rdata/generic/rkey_57.h create mode 100644 contrib/bind9/lib/dns/rdata/generic/sink_40.c create mode 100644 contrib/bind9/lib/dns/rdata/generic/sink_40.h create mode 100644 contrib/bind9/lib/dns/rdata/generic/smimea_53.c create mode 100644 contrib/bind9/lib/dns/rdata/generic/smimea_53.h create mode 100644 contrib/bind9/lib/dns/rdata/generic/ta_32768.c create mode 100644 contrib/bind9/lib/dns/rdata/generic/ta_32768.h create mode 100644 contrib/bind9/lib/dns/rdata/generic/talink_58.c create mode 100644 contrib/bind9/lib/dns/rdata/generic/talink_58.h diff --git a/contrib/bind9/CHANGES b/contrib/bind9/CHANGES index b2bd38aab..5b9e552bb 100644 --- a/contrib/bind9/CHANGES +++ b/contrib/bind9/CHANGES @@ -1,4 +1,96 @@ - --- 9.9.8-P4 released --- + --- 9.9.9-P3 released --- + +4467. [security] It was possible to trigger a assertion when rendering + a message. (CVE-2016-2776) [RT #43139] + + --- 9.9.9-P2 released --- + +4406. [bug] getrrsetbyname with a non absolute name could + trigger an infinite recursion bug in lwresd + and named with lwres configured if when combined + with a search list entry the resulting name is + too long. (CVE-2016-2775) [RT #42694] + +4405. [bug] Change 4342 introduced a regression where you could + not remove a delegation in a NSEC3 signed zone using + OPTOUT via nsupdate. [RT #42702] + +4387. [bug] Change 4336 was not complete leading to SERVFAIL + being return as NS records expired. [RT #42683] + + --- 9.9.9-P1 released --- + +4366. [bug] Address race condition when updating rbtnode bit + fields. [RT #42379] + +4363. [port] win32: Disable explicit triggering UAC when running + BINDInstall. + + --- 9.9.9 released --- + + --- 9.9.9rc1 released --- + +4347. [port] Corrected a build error on x86_64 Solaris. [RT #42150] + +4346. [bug] Fixed a regression introduced in change #4337 which + caused signed domains with revoked KSKs to fail + validation. [RT #42147] + +4345. [contrib] perftcpdns mishandled the return values from + clock_nanosleep. [RT #42131] + +4344. [port] Address openssl version differences. [RT #42059] + + --- 9.9.9b2 released --- + +4342. [bug] 'rndc flushtree' could fail to clean the tree if there + wasn't a node at the specified name. [RT #41846] + +4338. [bug] Reimplement change 4324 as it wasn't properly doing + all the required book keeping. [RT #41941] + +4337. [bug] The previous change exposed a latent flaw in + key refresh queries for managed-keys when + a cached DNSKEY had TTL 0. [RT #41986] + +4336. [bug] Don't emit records with zero ttl unless the records + were learnt with a zero ttl. [RT #41687] + +4335. [bug] zone->view could be detached too early. [RT #41942] + +4333. [maint] L.ROOT-SERVERS.NET is now 199.7.83.42 and + 2001:500:9f::42. + +4331. [func] When loading managed signed zones detect if the + RRSIG's inception time is in the future and regenerate + the RRSIG immediately. [RT #41808] + +4330. [protocol] Identify the PAD option as "PAD" when printing out + a message. + + --- 9.9.9b1 released --- + +4329. [func] Warn about a common misconfiguration when forwarding + RFC 1918 zones. [RT #41441] + +4328. [performance] Add dns_name_fromwire() benchmark test. [RT #41694] + +4327. [func] Log query and depth counters during fetches when + querytrace (./configure --enable-querytrace) is + enabled (helps in diagnosing). [RT #41787] + +4326. [protocol] Add support for AVC. [RT #41819] + +4324. [bug] When deleting records from a zone database, interior + nodes could be left empty but not deleted, damaging + search performance afterward. [RT #40997] + +4323. [bug] Improve HTTP header processing on statschannel. + [RT #41674] + +4320. [bug] Insufficient memory allocation when handling + "none" ACL could cause an assertion failure in + named when parsing ACL configuration. [RT #41745] 4319. [security] Fix resolver assertion failure due to improper DNAME handling when parsing fetch reply messages. @@ -7,20 +99,122 @@ 4318. [security] Malformed control messages can trigger assertions in named and rndc. (CVE-2016-1285) [RT #41666] - --- 9.9.8-P3 released --- +4317. [bug] Age all unused servers on fetch timeout. [RT #41597] + +4315. [bug] Check that configured view class isn't a meta class. + [RT #41572]. + +4314. [contrib] Added 'dnsperf-2.1.0.0-1', a set of performance + testing tools provided by Nominum, Inc. + +4313. [bug] Handle ns_client_replace failures in test mode. + [RT #41190] + +4312. [bug] dig's unknown DNS and EDNS flags (MBZ value) logging + was not consistent. [RT #41600] + +4311. [bug] Prevent "rndc delzone" from being used on + response-policy zones. [RT #41593] + +4310. [performance] Use __builtin_expect() where available to annotate + conditions with known behavior. [RT #41411] + +4308. [func] Added operating system details to "named -V" + output. [RT #41452] + +4306. [maint] Added a PKCS#11 openssl patch supporting + version 1.0.2f [RT #38312] + +4305. [bug] dnssec-signzone was not removing unnecessary rrsigs + from the zone's apex. [RT #41483] + +4304. [port] xfer system test failed as 'tail -n +value' is not + portable. [RT #41315] + +4302. [port] win32: fixed a build error in VS 2015. [RT #41426] + +4300. [cleanup] Added new querytrace logging. [RT #41155] + +4299. [bug] Check that exactly totallen bytes are read when + reading a RRset from raw files in both single read + and incremental modes. [RT #41402] + +4297. [bug] RPZ zones with errors could cause a crash when a + pointer was cleaned up twice. [RT #41518] + +4295. [bug] An unchecked result in dns_message_pseudosectiontotext() + could allow incorrect text formatting of EDNS EXPIRE + options. [RT #41437] + +4294. [bug] Fixed a regression in which "rndc stop -p" failed + to print the PID. [RT #41513] + +4293. [bug] Address memory leak on priming query creation failure. + [RT #41512] + +4292. [bug] Build lib/export/dns/gen with native compiler. + [RT #41502] + +4291. [cleanup] Added a required include to dns/forward.h. [RT #41474] + +4289. [bug] The server could crash due to memory being used + after it was freed if a zone transfer timed out. + [RT #41297] 4288. [bug] Fixed a regression in resolver.c:possibly_mark() which caused known-bogus servers to be queried anyway. [RT #41321] +4287. [bug] Silence an overly noisy log message when message + parsing fails. [RT #41374] + 4285. [security] Specific APL data could trigger a INSIST. (CVE-2015-8704) [RT #41396] - --- 9.9.8-P2 released --- +4283. [bug] OPENSSL_config is no longer re-callable. [RT #41348] + +4281. [bug] Teach dns_message_totext about BADCOOKIE. [RT #41257] + +4280. [performance] Use optimal message sizes to improve compression + in AXFRs. This reduces network traffic. [RT #40996] + +4277. [performance] Improve performance of the RBT, the central zone + datastructure: The aux hashtable was improved, + hash function was updated to perform more + uniform mapping, uppernode was added to + dns_rbtnode, and other cleanups and performance + improvements were made. [RT #41165] + +4276. [protocol] Add support for SMIMEA. [RT #40513] + +4274. [performance] Speed up typemap processing from text. [RT #41196] + +4272. [bug] dig: the +norrcomments option didn't work with +multi. + [RT #41234] + +4271. [test] Unit tests could deadlock in isc__taskmgr_pause(). + [RT #41235] 4270. [security] Update allowed OpenSSL versions as named is potentially vulnerable to CVE-2015-3193. +4267. [test] Check sdlz error handling. [RT #41142] + +4266. [bug] The sdlz driver failed to pass some errors back to + the caller. [RT #41142] + +4265. [bug] Address unchecked isc_mem_get calls. [RT #41187] + +4264. [bug] Check const of strchr/strrchr assignments match + argument's const status. [RT #41150] + +4262. [bug] Fixed a bug in epoll socket code that caused + sockets to not be registered for ready + notification in some cases, causing named to not + read from or write to them, resulting in what + appear to the user as blocked connections. + [RT #41067] + 4261. [maint] H.ROOT-SERVERS.NET is 198.97.190.53 and 2001:500:1::53. [RT #40556] @@ -29,10 +223,123 @@ triggering a REQUIRE failure when those records were subsequently cached. (CVE-2015-8000) [RT #40987] +4258. [bug] Limit rndc query message sizes to 32 KiB. This should + not break any legitimate rndc commands, but will + prevent a rogue rndc query from allocating too + much memory. [RT #41073] + +4257. [cleanup] Python scripts reported incorrect version. [RT #41080] + +4256. [bug] Allow rndc command arguments to be quoted so as + to allow spaces. [RT #36665] + +4254. [bug] Address missing lock when getting zone's serial. + [RT #41072] + 4253. [security] Address fetch context reference count handling error - on socket error. (CVE-2015-8461) [RT#40945] + on socket error. (CVE-2015-8461) [RT#40945] + +4248. [performance] Add an isc_atomic_storeq() function, use it in + stats counters to improve performance. + [RT #39972] [RT #39979] + +4244. [bug] The parser was not reporting that use-ixfr is obsolete. + [RT #41010] + +4241. [doc] Improved the TSIG, TKEY, and SIG(0) sections in + the ARM. [RT #40955] + +4240. [port] Fix LibreSSL compatibility. [RT #40977] + +4238. [bug] Don't send to servers on net zero (0.0.0.0/8). + [RT #40947] + +4237. [doc] Upgraded documentation toolchain to use DocBook 5 + and dblatex. [RT #40766] + +4236. [performance] On machines with 2 or more processors (CPU), the + default value for the number of UDP listeners + has been changed to the number of detected + processors minus one. [RT #40761] + +4233. [test] Add tests for CDS and CDNSKEY with delegation-only. + [RT #40597] + +4232. [contrib] Address unchecked memory allocation calls in + query-loc and zone2ldap. [RT #40789] + +4229. [bug] A variable could be used uninitialized in + dns_update_signaturesinc. [RT #40784] + +4228. [bug] Address race condition in dns_client_destroyrestrans. + [RT #40605] + +4227. [bug] Silence static analysis warnings. [RT #40828] + +4226. [bug] Address a theoretical shutdown race in + zone.c:notify_send_queue(). [RT #38958] + +4225. [port] freebsd/openbsd: Use '${CC} -shared' for building + shared libraries. [RT #39557] + +4221. [bug] Resource leak on DNS_R_NXDOMAIN in fctx_create. + [RT #40583] + +4220. [doc] Improve documentation for zone-statistics. + [RT #36955] + +4219. [bug] Set event->result to ISC_R_WOULDBLOCK on EWOULDBLOCK, + EGAIN when these soft error are not retried for + isc_socket_send*(). + +4217. [protocol] Add support for CSYNC. [RT #40532] + +4216. [cleanup] Silence static analysis warnings. [RT #40649] + +4215. [bug] nsupdate: skip to next request on GSSTKEY create + failure. [RT #40685] + +4214. [protocol] Add support for TALINK. [RT #40544] + +4213. [bug] Don't reuse a cache across multiple classes. + [RT #40205] + +4210. [cleanup] Silence use after free false positive. [RT #40743] + +4208. [bug] Address null pointer dereferences on out of memory. + [RT #40764] + +4207. [bug] Handle class mismatches with raw zone files. + [RT #40746] + +4205. [bug] 'named-checkconf -p' could include unwanted spaces + when printing tuples with unset optional fields. + [RT #40731] + +4204. [bug] 'dig +trace' failed to lookup the correct type if + the initial root NS query was retried. [RT #40296] + +4202. [bug] isccc_cc_fromwire() could return an incorrect + result. [RT #40614] + +4201. [func] The default preferred-glue is now the address record + type of the transport the query was received + over. [RT #40468] + +4200. [cleanup] win32: update BINDinstall to be BIND release + independent. [RT #38915] + +4199. [protocol] Add support for NINFO, RKEY, SINK, TA. + [RT #40545] [RT #40547] [RT #40561] [RT #40563] + +4198. [doc] Add fetch-quota-params, fetches-per-server, and + fetches-per-zone to doc/misc/options. [RT #40601] + +4196. [doc] Improve how "enum + other" types are documented. + [RT #40608] - --- 9.9.8-P1 (withdrawn) --- +4194. [bug] named-checkconf -p failed to properly print a port + range. [RT #40634] --- 9.9.8 released --- @@ -47,7 +354,7 @@ 4191. [protocol] Accept DNS-SD non LDH PTR records in reverse zones as per RFC 6763. [RT #37889] -4190. [protocol] Accept Active Diretory gc._msdcs. name as +4190. [protocol] Accept Active Directory gc._msdcs. name as valid with check-names. still needs to be LDH. [RT #40399] diff --git a/contrib/bind9/FAQ b/contrib/bind9/FAQ index 2b71a1930..6a75e8af8 100644 --- a/contrib/bind9/FAQ +++ b/contrib/bind9/FAQ @@ -1,10 +1,6 @@ -Frequently Asked Questions about BIND 9 - -Copyright © 2004-2010, 2013, 2014 Internet Systems Consortium, Inc. +Copyright ? 2000-2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC") -Copyright © 2000-2003 Internet Software Consortium. - ----------------------------------------------------------------------- 1. Compilation and Installation Questions @@ -94,7 +90,7 @@ Q: I'm trying to use TSIG to authenticate dynamic updates or zone rejecting the TSIG. Why? A: This may be a clock skew problem. Check that the the clocks on the - client and server are properly synchronised (e.g., using ntp). + client and server are properly synchronized (e.g., using ntp). Q: I see a log message like the following. Why? diff --git a/contrib/bind9/FAQ.xml b/contrib/bind9/FAQ.xml index 9c56f8123..3ba9d9129 100644 --- a/contrib/bind9/FAQ.xml +++ b/contrib/bind9/FAQ.xml @@ -1,7 +1,5 @@ - - + +
-
- Frequently Asked Questions about BIND 9 2004 @@ -32,6 +29,8 @@ 2010 2013 2014 + 2015 + 2016 Internet Systems Consortium, Inc. ("ISC") @@ -42,10 +41,10 @@ Internet Software Consortium. - - - Compilation and Installation Questions - + + + Compilation and Installation Questions + @@ -61,7 +60,7 @@ - + @@ -70,7 +69,7 @@ - Short Answer: No. + Short Answer: No. Long Answer: There really isn't a default configuration which fits @@ -93,9 +92,9 @@ - + - + Configuration and Setup Questions @@ -125,7 +124,7 @@ example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 ) - + @@ -223,7 +222,7 @@ view "chaos" chaos { This may be a clock skew problem. Check that the the clocks - on the client and server are properly synchronised (e.g., + on the client and server are properly synchronized (e.g., using ntp). @@ -251,7 +250,7 @@ view "chaos" chaos { - + @@ -266,7 +265,7 @@ view "chaos" chaos { - + @@ -359,7 +358,7 @@ Slave 10.0.1.2: - + @@ -392,7 +391,7 @@ named-checkzone example.com tmp - + @@ -416,7 +415,7 @@ named-checkzone example.com tmp - + @@ -501,7 +500,7 @@ Master 10.0.1.1: You are running chrooted (-t) and have not supplied local timezone information in the chroot area. - + FreeBSD: /etc/localtime Solaris: /etc/TIMEZONE and /usr/share/lib/zoneinfo OSF: /etc/zoneinfo/localtime @@ -511,7 +510,7 @@ Master 10.0.1.1: - + @@ -551,7 +550,7 @@ Master 10.0.1.1: - + @@ -603,7 +602,7 @@ zone "example.net" { - + @@ -694,9 +693,9 @@ server ::/0 { bogus yes; }; - + - + Operations Questions @@ -768,7 +767,7 @@ server ::/0 { bogus yes; }; General Questions - + @@ -807,14 +806,13 @@ server ::/0 { bogus yes; }; of sending dynamic update requests to DNS servers without being specifically configured to do so. If the update requests are coming from a Windows 2000 machine, see - - <http://support.microsoft.com/support/kb/articles/q246/8/04.asp> + + <http://support.microsoft.com/support/kb/articles/q246/8/04.asp> for information about how to turn them off. - + @@ -849,7 +847,7 @@ server ::/0 { bogus yes; }; - + @@ -867,7 +865,7 @@ server ::/0 { bogus yes; }; - + @@ -883,7 +881,7 @@ server ::/0 { bogus yes; }; - + @@ -910,7 +908,7 @@ serial-query-rate 5; // default 20 - + I don't get RRSIG's returned when I use "dig +dnssec". @@ -922,7 +920,7 @@ serial-query-rate 5; // default 20 - + @@ -959,7 +957,7 @@ serial-query-rate 5; // default 20 usage rules and are leaking queries to the Internet. You should establish your own zones for these addresses to prevent you querying the Internet's name servers for these addresses. - Please see <http://as112.net/> + Please see <http://as112.net/> for details of the problems you are causing and the counter measures that have had to be deployed. @@ -1006,7 +1004,7 @@ empty: - + @@ -1083,9 +1081,9 @@ empty: - + Operating-System Specific Questions - + HPUX @@ -1113,9 +1111,9 @@ configure: error: need either working unistd.h or sys/select.h Linux - + - + Why do I get the following errors: general: errno2result.c:109: unexpected error: @@ -1129,7 +1127,7 @@ client: UDP client handler shutting down due to fatal receive error: unexpected See: - <http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2> + <http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2> @@ -1146,9 +1144,9 @@ client: UDP client handler shutting down due to fatal receive error: unexpected non-blocking is ignored. It is reported that setting xfrm_larval_drop to 1 helps but this may have negative side effects. See: -<https://bugzilla.redhat.com/show_bug.cgi?id=427629> +<https://bugzilla.redhat.com/show_bug.cgi?id=427629> and -<http://lkml.org/lkml/2007/12/4/260>. +<http://lkml.org/lkml/2007/12/4/260>. xfrm_larval_drop can be set to 1 by the following procedure: @@ -1178,7 +1176,7 @@ echo "1" > proc/sys/net/core/xfrm_larval_drop - + @@ -1197,7 +1195,7 @@ echo "1" > proc/sys/net/core/xfrm_larval_drop - + @@ -1218,7 +1216,7 @@ modprobe capability - + @@ -1244,8 +1242,7 @@ modprobe capability Red Hat have adopted the National Security Agency's - SELinux security policy (see <http://www.nsa.gov/selinux>) + SELinux security policy (see <http://www.nsa.gov/selinux>) and recommendations for BIND security , which are more secure than running named in a chroot and make use of the bind-chroot environment unnecessary . @@ -1279,7 +1276,7 @@ $ROOTDIR/var/tmp able to write or create files except in the directories above, with SELinux in Enforcing mode. - + So, to allow named to update slave or DDNS zone files, it is best to locate them in $ROOTDIR/var/named/slaves, @@ -1290,7 +1287,7 @@ zone "slave.zone." IN { type slave; file "slaves/slave.zone.db"; ... -}; +}; zone "ddns.zone." IN { type master; allow-updates {...}; @@ -1323,13 +1320,13 @@ options { system-config-securitylevel GUI, using the 'setsebool' command, or in /etc/selinux/targeted/booleans. - + You can disable SELinux protection for named entirely by setting the 'named_disable_trans=1' SELinux tunable boolean parameter. - + The SELinux named policy defines these SELinux contexts for named: @@ -1340,7 +1337,7 @@ named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,d - + If you want to retain use of the SELinux policy for named, and put named files in different locations, you can do @@ -1358,7 +1355,7 @@ named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,d - + To create a custom modifiable named data location, e.g. '/var/log/named' for a log file, do: @@ -1368,7 +1365,7 @@ named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,d - + To create a custom zone file location, e.g. /root/zones/, do: @@ -1377,7 +1374,7 @@ named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,d - + See these man-pages for more information : selinux(8), named_selinux(8), chcon(1), setsebool(8) @@ -1403,8 +1400,8 @@ named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,d - Ubuntu uses AppArmor - <http://en.wikipedia.org/wiki/AppArmor> in + Ubuntu uses AppArmor + <http://en.wikipedia.org/wiki/AppArmor> in addition to normal file system permissions to protect the system. @@ -1438,11 +1435,11 @@ proc /var/named/proc proc defaults 0 0 - + - + Windows - + @@ -1463,7 +1460,7 @@ proc /var/named/proc proc defaults 0 0 - + @@ -1489,11 +1486,11 @@ options { - + - + FreeBSD - + @@ -1513,16 +1510,16 @@ rand_irqs="3 14 15" See also - - <http://people.freebsd.org/~dougb/randomness.html>. + + <http://people.freebsd.org/~dougb/randomness.html>. - + - + Solaris - + @@ -1534,15 +1531,14 @@ rand_irqs="3 14 15" Sun has a blog entry describing how to do this. - + <http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris> - + - - + + Apple Mac OS X @@ -1558,7 +1554,7 @@ rand_irqs="3 14 15" -% sudo rndc-confgen > /etc/rndc.conf +% sudo rndc-confgen > /etc/rndc.conf Copy the key statement from /etc/rndc.conf into /etc/rndc.key, e.g.: @@ -1606,8 +1602,8 @@ key "rndc-key" { - - + + diff --git a/contrib/bind9/Makefile.in b/contrib/bind9/Makefile.in index 2c5985f81..4f7f5a64b 100644 --- a/contrib/bind9/Makefile.in +++ b/contrib/bind9/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004-2009, 2011-2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004-2009, 2011-2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2002 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ SUBDIRS = make unit lib bin doc @LIBEXPORT@ TARGETS = @@ -32,6 +32,9 @@ MANOBJS = ${MANPAGES} ${HTMLPAGES} @BIND9_MAKE_RULES@ +newrr: + cd lib/dns; ${MAKE} newrr + distclean:: rm -f config.cache config.h config.log config.status TAGS rm -f libtool isc-config.sh configure.lineno diff --git a/contrib/bind9/README b/contrib/bind9/README index d0aab2c0b..d0b355689 100644 --- a/contrib/bind9/README +++ b/contrib/bind9/README @@ -51,27 +51,29 @@ BIND 9 For up-to-date release notes and errata, see http://www.isc.org/software/bind9/releasenotes -BIND 9.9.8-P4 +BIND 9.9.9-P3 - BIND 9.9.8-P4 is a security release addressing the flaws - described in CVE-2016-1285 and CVE-2016-1286. + This version contains a fix for CVE-2016-2776. -BIND 9.9.8-P3 +BIND 9.9.9-P2 - BIND 9.9.8-P3 is a security release addressing the flaw described in - CVE-2015-8704. It also fixes a serious regression in authoritative - server selection that was introduced in 9.9.8. + This version contains a fix for CVE-2016-2775 and addresses + two regressions introduced with BIND 9.9.9. -BIND 9.9.8-P2 +BIND 9.9.9-P1 - BIND 9.9.8-P2 is a security release addressing the flaws - described in CVE-2015-3193 (OpenSSL), CVE-2015-8000 and - CVE-2015-8461. + This version contains two urgent fixes to BIND 9.9.9: + 1) Windows installation was failing without manual updating + of BINDinstall's attributes. + 2) A race condition was causing instability in the rbt + tree state. -BIND 9.9.8-P1 +BIND 9.9.9 - BIND 9.9.8-P1 was incomplete and was withdrawn prior to - publication. + BIND 9.9.9 is a maintenance release and addresses bugs found + in BIND 9.9.8 and earlier, as well as the security flaws + described in CVE-2015-8000, CVE-2015-8461, CVE-2015-8704, + CVE-2016-1285, and CVE-2016-1286. BIND 9.9.8 @@ -313,7 +315,7 @@ Building a nonstandard prefix, you can tell configure where to look for it using "--with-openssl=/prefix". - On some platforms it is necessary to explictly request large + On some platforms it is necessary to explicitly request large file support to handle files bigger than 2GB. This can be done by "--enable-largefile" on the configure command line. @@ -425,9 +427,11 @@ Change Log server addresses and keys [tuning] Changes to built-in configuration defaults - and constants to improve performanceo + and constants to improve performance - [protocol] Updates to the DNS protocol such as new + [performance] Other changes to improve server performance + + [protocol] Updates to the DNS protocol such as new RR types [test] Changes to the automatic tests, not diff --git a/contrib/bind9/acconfig.h b/contrib/bind9/acconfig.h index 14eca17cf..762b11ba4 100644 --- a/contrib/bind9/acconfig.h +++ b/contrib/bind9/acconfig.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2008, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2008, 2012, 2014, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -149,3 +149,6 @@ int sigwait(const unsigned int *set, int *sig); /* Define if threads need PTHREAD_SCOPE_SYSTEM */ #undef NEED_PTHREAD_SCOPE_SYSTEM + +/* Define to 1 if you have the uname library function. */ +#undef HAVE_UNAME diff --git a/contrib/bind9/bin/check/Makefile.in b/contrib/bind9/bin/check/Makefile.in index b88be3cb8..fb6c304db 100644 --- a/contrib/bind9/bin/check/Makefile.in +++ b/contrib/bind9/bin/check/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004-2007, 2009, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004-2007, 2009, 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000-2003 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @BIND9_MAKE_INCLUDES@ diff --git a/contrib/bind9/bin/check/named-checkconf.8 b/contrib/bind9/bin/check/named-checkconf.8 index ad6c497f3..cab8e22f8 100644 --- a/contrib/bind9/bin/check/named-checkconf.8 +++ b/contrib/bind9/bin/check/named-checkconf.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2002 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,115 +13,131 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: named\-checkconf +'\" t +.\" Title: named-checkconf .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: January 10, 2014 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2014-01-10 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "NAMED\-CHECKCONF" "8" "January 10, 2014" "BIND9" "BIND9" +.TH "NAMED\-CHECKCONF" "8" "2014\-01\-10" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -named\-checkconf \- named configuration file syntax checking tool +named-checkconf \- named configuration file syntax checking tool .SH "SYNOPSIS" -.HP 16 +.HP \w'\fBnamed\-checkconf\fR\ 'u \fBnamed\-checkconf\fR [\fB\-h\fR] [\fB\-v\fR] [\fB\-j\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename} [\fB\-p\fR] [\fB\-x\fR] [\fB\-z\fR] .SH "DESCRIPTION" .PP \fBnamed\-checkconf\fR checks the syntax, but not the semantics, of a \fBnamed\fR -configuration file. The file is parsed and checked for syntax errors, along with all files included by it. If no file is specified, -\fI/etc/named.conf\fR -is read by default. +configuration file\&. The file is parsed and checked for syntax errors, along with all files included by it\&. If no file is specified, +/etc/named\&.conf +is read by default\&. .PP Note: files that \fBnamed\fR reads in separate parser contexts, such as -\fIrndc.key\fR +rndc\&.key and -\fIbind.keys\fR, are not automatically read by -\fBnamed\-checkconf\fR. Configuration errors in these files may cause +bind\&.keys, are not automatically read by +\fBnamed\-checkconf\fR\&. Configuration errors in these files may cause \fBnamed\fR to fail to run, even if \fBnamed\-checkconf\fR -was successful. +was successful\&. \fBnamed\-checkconf\fR -can be run on these files explicitly, however. +can be run on these files explicitly, however\&. .SH "OPTIONS" .PP \-h .RS 4 -Print the usage summary and exit. +Print the usage summary and exit\&. .RE .PP \-t \fIdirectory\fR .RS 4 Chroot to -\fIdirectory\fR -so that include directives in the configuration file are processed as if run by a similarly chrooted named. +directory +so that include directives in the configuration file are processed as if run by a similarly chrooted named\&. .RE .PP \-v .RS 4 Print the version of the \fBnamed\-checkconf\fR -program and exit. +program and exit\&. .RE .PP \-p .RS 4 Print out the -\fInamed.conf\fR -and included files in canonical form if no errors were detected. +named\&.conf +and included files in canonical form if no errors were detected\&. .RE .PP \-x .RS 4 -When printing the configuration files in canonical form, obscure shared secrets by replacing them with strings of question marks ('?'). This allows the contents of -\fInamed.conf\fR -and related files to be shared \(em for example, when submitting bug reports \(em without compromising private data. This option cannot be used without -\fB\-p\fR. +When printing the configuration files in canonical form, obscure shared secrets by replacing them with strings of question marks (\*(Aq?\*(Aq)\&. This allows the contents of +named\&.conf +and related files to be shared \(em for example, when submitting bug reports \(em without compromising private data\&. This option cannot be used without +\fB\-p\fR\&. .RE .PP \-z .RS 4 Perform a test load of all master zones found in -\fInamed.conf\fR. +named\&.conf\&. .RE .PP \-j .RS 4 -When loading a zonefile read the journal if it exists. +When loading a zonefile read the journal if it exists\&. .RE .PP filename .RS 4 -The name of the configuration file to be checked. If not specified, it defaults to -\fI/etc/named.conf\fR. +The name of the configuration file to be checked\&. If not specified, it defaults to +/etc/named\&.conf\&. .RE .SH "RETURN VALUES" .PP \fBnamed\-checkconf\fR -returns an exit status of 1 if errors were detected and 0 otherwise. +returns an exit status of 1 if errors were detected and 0 otherwise\&. .SH "SEE ALSO" .PP \fBnamed\fR(8), -\fBnamed\-checkzone\fR(8), -BIND 9 Administrator Reference Manual. +\fBnamed-checkzone\fR(8), +BIND 9 Administrator Reference Manual\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2009, 2014 Internet Systems Consortium, Inc. ("ISC") .br -Copyright \(co 2000\-2002 Internet Software Consortium. +Copyright \(co 2004, 2005, 2007, 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2000-2002 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/check/named-checkconf.c b/contrib/bind9/bin/check/named-checkconf.c index a2a0856de..be05a35e7 100644 --- a/contrib/bind9/bin/check/named-checkconf.c +++ b/contrib/bind9/bin/check/named-checkconf.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -421,15 +421,27 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config, return (result); } +static isc_result_t +config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass, + dns_rdataclass_t *classp) +{ + isc_textregion_t r; + + if (!cfg_obj_isstring(classobj)) { + *classp = defclass; + return (ISC_R_SUCCESS); + } + DE_CONST(cfg_obj_asstring(classobj), r.base); + r.length = strlen(r.base); + return (dns_rdataclass_fromtext(classp, &r)); +} /*% load zones from the configuration */ static isc_result_t load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx) { const cfg_listelt_t *element; - const cfg_obj_t *classobj; const cfg_obj_t *views; const cfg_obj_t *vconfig; - const char *vclass; isc_result_t result = ISC_R_SUCCESS; isc_result_t tresult; @@ -440,17 +452,24 @@ load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx) { element != NULL; element = cfg_list_next(element)) { + const cfg_obj_t *classobj; + dns_rdataclass_t viewclass; const char *vname; + char buf[sizeof("CLASS65535")]; - vclass = "IN"; vconfig = cfg_listelt_value(element); - if (vconfig != NULL) { - classobj = cfg_tuple_get(vconfig, "class"); - if (cfg_obj_isstring(classobj)) - vclass = cfg_obj_asstring(classobj); - } + if (vconfig == NULL) + continue; + + classobj = cfg_tuple_get(vconfig, "class"); + CHECK(config_getclass(classobj, dns_rdataclass_in, + &viewclass)); + if (dns_rdataclass_ismeta(viewclass)) + CHECK(ISC_R_FAILURE); + + dns_rdataclass_format(viewclass, buf, sizeof(buf)); vname = cfg_obj_asstring(cfg_tuple_get(vconfig, "name")); - tresult = configure_view(vclass, vname, config, vconfig, mctx); + tresult = configure_view(buf, vname, config, vconfig, mctx); if (tresult != ISC_R_SUCCESS) result = tresult; } @@ -460,6 +479,8 @@ load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx) { if (tresult != ISC_R_SUCCESS) result = tresult; } + +cleanup: return (result); } diff --git a/contrib/bind9/bin/check/named-checkconf.docbook b/contrib/bind9/bin/check/named-checkconf.docbook index a5e50334e..87b68f365 100644 --- a/contrib/bind9/bin/check/named-checkconf.docbook +++ b/contrib/bind9/bin/check/named-checkconf.docbook @@ -1,8 +1,7 @@ -]> +]> - + + + + 2014-01-10 + - January 10, 2014 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +40,7 @@ 2007 2009 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -52,21 +57,21 @@ - + named-checkconf - - - - - filename - - - + + + + + filename + + + - - DESCRIPTION + DESCRIPTION + named-checkconf checks the syntax, but not the semantics, of a named configuration file. The file is parsed @@ -84,10 +89,10 @@ successful. named-checkconf can be run on these files explicitly, however. - + + + OPTIONS - - OPTIONS @@ -176,18 +181,18 @@ - + + + RETURN VALUES - - RETURN VALUES named-checkconf returns an exit status of 1 if errors were detected and 0 otherwise. - + + + SEE ALSO - - SEE ALSO named8 , @@ -196,16 +201,5 @@ , BIND 9 Administrator Reference Manual. - - - - AUTHOR - Internet Systems Consortium - - - - + + diff --git a/contrib/bind9/bin/check/named-checkconf.html b/contrib/bind9/bin/check/named-checkconf.html index 8caabf260..89524ab0d 100644 --- a/contrib/bind9/bin/check/named-checkconf.html +++ b/contrib/bind9/bin/check/named-checkconf.html @@ -1,5 +1,5 @@ - named-checkconf - + -
+

Name

@@ -31,29 +30,29 @@

Synopsis

named-checkconf [-h] [-v] [-j] [-t directory] {filename} [-p] [-x] [-z]

-
-

DESCRIPTION

-

named-checkconf +

+

DESCRIPTION

+

named-checkconf checks the syntax, but not the semantics, of a - named configuration file. The file is parsed + named configuration file. The file is parsed and checked for syntax errors, along with all files included by it. If no file is specified, /etc/named.conf is read by default.

- Note: files that named reads in separate + Note: files that named reads in separate parser contexts, such as rndc.key and bind.keys, are not automatically read - by named-checkconf. Configuration - errors in these files may cause named to - fail to run, even if named-checkconf was - successful. named-checkconf can be run + by named-checkconf. Configuration + errors in these files may cause named to + fail to run, even if named-checkconf was + successful. named-checkconf can be run on these files explicitly, however.

-
-

OPTIONS

-
+
+

OPTIONS

+
-h

Print the usage summary and exit. @@ -66,7 +65,7 @@

-v

- Print the version of the named-checkconf + Print the version of the named-checkconf program and exit.

-p
@@ -100,24 +99,19 @@

-
-

RETURN VALUES

-

named-checkconf +

+

RETURN VALUES

+

named-checkconf returns an exit status of 1 if errors were detected and 0 otherwise.

-
-

SEE ALSO

+
+

SEE ALSO

named(8), named-checkzone(8), BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
diff --git a/contrib/bind9/bin/check/named-checkzone.8 b/contrib/bind9/bin/check/named-checkzone.8 index f9bba0e73..3f8ca0550 100644 --- a/contrib/bind9/bin/check/named-checkzone.8 +++ b/contrib/bind9/bin/check/named-checkzone.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2007, 2009-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2007, 2009-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2002 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,106 +13,121 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: named\-checkzone +'\" t +.\" Title: named-checkzone .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: April 29, 2013 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2013-04-29 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "NAMED\-CHECKZONE" "8" "April 29, 2013" "BIND9" "BIND9" +.TH "NAMED\-CHECKZONE" "8" "2013\-04\-29" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -named\-checkzone, named\-compilezone \- zone file validity checking or converting tool +named-checkzone, named-compilezone \- zone file validity checking or converting tool .SH "SYNOPSIS" -.HP 16 +.HP \w'\fBnamed\-checkzone\fR\ 'u \fBnamed\-checkzone\fR [\fB\-d\fR] [\fB\-h\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-M\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-o\ \fR\fB\fIfilename\fR\fR] [\fB\-r\ \fR\fB\fImode\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-S\ \fR\fB\fImode\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-T\ \fR\fB\fImode\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {zonename} {filename} -.HP 18 +.HP \w'\fBnamed\-compilezone\fR\ 'u \fBnamed\-compilezone\fR [\fB\-d\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-C\ \fR\fB\fImode\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-r\ \fR\fB\fImode\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-T\ \fR\fB\fImode\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {\fB\-o\ \fR\fB\fIfilename\fR\fR} {zonename} {filename} .SH "DESCRIPTION" .PP \fBnamed\-checkzone\fR -checks the syntax and integrity of a zone file. It performs the same checks as +checks the syntax and integrity of a zone file\&. It performs the same checks as \fBnamed\fR -does when loading a zone. This makes +does when loading a zone\&. This makes \fBnamed\-checkzone\fR -useful for checking zone files before configuring them into a name server. +useful for checking zone files before configuring them into a name server\&. .PP \fBnamed\-compilezone\fR is similar to -\fBnamed\-checkzone\fR, but it always dumps the zone contents to a specified file in a specified format. Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file loaded by -\fBnamed\fR. When manually specified otherwise, the check levels must at least be as strict as those specified in the +\fBnamed\-checkzone\fR, but it always dumps the zone contents to a specified file in a specified format\&. Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file loaded by +\fBnamed\fR\&. When manually specified otherwise, the check levels must at least be as strict as those specified in the \fBnamed\fR -configuration file. +configuration file\&. .SH "OPTIONS" .PP \-d .RS 4 -Enable debugging. +Enable debugging\&. .RE .PP \-h .RS 4 -Print the usage summary and exit. +Print the usage summary and exit\&. .RE .PP \-q .RS 4 -Quiet mode \- exit code only. +Quiet mode \- exit code only\&. .RE .PP \-v .RS 4 Print the version of the \fBnamed\-checkzone\fR -program and exit. +program and exit\&. .RE .PP \-j .RS 4 -When loading the zone file read the journal if it exists. +When loading the zone file read the journal if it exists\&. .RE .PP \-c \fIclass\fR .RS 4 -Specify the class of the zone. If not specified, "IN" is assumed. +Specify the class of the zone\&. If not specified, "IN" is assumed\&. .RE .PP \-i \fImode\fR .RS 4 -Perform post\-load zone integrity checks. Possible modes are +Perform post\-load zone integrity checks\&. Possible modes are \fB"full"\fR (default), \fB"full\-sibling"\fR, \fB"local"\fR, \fB"local\-sibling"\fR and -\fB"none"\fR. +\fB"none"\fR\&. .sp Mode \fB"full"\fR -checks that MX records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames). Mode +checks that MX records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames)\&. Mode \fB"local"\fR -only checks MX records which refer to in\-zone hostnames. +only checks MX records which refer to in\-zone hostnames\&. .sp Mode \fB"full"\fR -checks that SRV records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames). Mode +checks that SRV records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames)\&. Mode \fB"local"\fR -only checks SRV records which refer to in\-zone hostnames. +only checks SRV records which refer to in\-zone hostnames\&. .sp Mode \fB"full"\fR -checks that delegation NS records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode +checks that delegation NS records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames)\&. It also checks that glue address records in the zone match those advertised by the child\&. Mode \fB"local"\fR -only checks NS records which refer to in\-zone hostnames or that some required glue exists, that is when the nameserver is in a child zone. +only checks NS records which refer to in\-zone hostnames or that some required glue exists, that is when the nameserver is in a child zone\&. .sp Mode \fB"full\-sibling"\fR @@ -122,25 +137,25 @@ disable sibling glue checks but are otherwise the same as \fB"full"\fR and \fB"local"\fR -respectively. +respectively\&. .sp Mode \fB"none"\fR -disables the checks. +disables the checks\&. .RE .PP \-f \fIformat\fR .RS 4 -Specify the format of the zone file. Possible formats are +Specify the format of the zone file\&. Possible formats are \fB"text"\fR (default) and -\fB"raw"\fR. +\fB"raw"\fR\&. .RE .PP \-F \fIformat\fR .RS 4 -Specify the format of the output file specified. For -\fBnamed\-checkzone\fR, this does not cause any effects unless it dumps the zone contents. +Specify the format of the output file specified\&. For +\fBnamed\-checkzone\fR, this does not cause any effects unless it dumps the zone contents\&. .sp Possible formats are \fB"text"\fR @@ -148,161 +163,162 @@ Possible formats are \fB"raw"\fR or \fB"raw=N"\fR, which store the zone in a binary format for rapid loading by -\fBnamed\fR. +\fBnamed\fR\&. \fB"raw=N"\fR specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of -\fBnamed\fR; if N is 1, the file can be read by release 9.9.0 or higher. The default is 1. +\fBnamed\fR; if N is 1, the file can be read by release 9\&.9\&.0 or higher\&. The default is 1\&. .RE .PP \-k \fImode\fR .RS 4 Perform \fB"check\-names"\fR -checks with the specified failure mode. Possible modes are +checks with the specified failure mode\&. Possible modes are \fB"fail"\fR (default for \fBnamed\-compilezone\fR), \fB"warn"\fR (default for \fBnamed\-checkzone\fR) and -\fB"ignore"\fR. +\fB"ignore"\fR\&. .RE .PP \-L \fIserial\fR .RS 4 -When compiling a zone to 'raw' format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.) +When compiling a zone to \*(Aqraw\*(Aq format, set the "source serial" value in the header to the specified serial number\&. (This is expected to be used primarily for testing purposes\&.) .RE .PP \-m \fImode\fR .RS 4 -Specify whether MX records should be checked to see if they are addresses. Possible modes are +Specify whether MX records should be checked to see if they are addresses\&. Possible modes are \fB"fail"\fR, \fB"warn"\fR (default) and -\fB"ignore"\fR. +\fB"ignore"\fR\&. .RE .PP \-M \fImode\fR .RS 4 -Check if a MX record refers to a CNAME. Possible modes are +Check if a MX record refers to a CNAME\&. Possible modes are \fB"fail"\fR, \fB"warn"\fR (default) and -\fB"ignore"\fR. +\fB"ignore"\fR\&. .RE .PP \-n \fImode\fR .RS 4 -Specify whether NS records should be checked to see if they are addresses. Possible modes are +Specify whether NS records should be checked to see if they are addresses\&. Possible modes are \fB"fail"\fR (default for \fBnamed\-compilezone\fR), \fB"warn"\fR (default for \fBnamed\-checkzone\fR) and -\fB"ignore"\fR. +\fB"ignore"\fR\&. .RE .PP \-o \fIfilename\fR .RS 4 Write zone output to -\fIfilename\fR. If -\fIfilename\fR +filename\&. If +filename is -\fI\-\fR -then write to standard out. This is mandatory for -\fBnamed\-compilezone\fR. +\- +then write to standard out\&. This is mandatory for +\fBnamed\-compilezone\fR\&. .RE .PP \-r \fImode\fR .RS 4 -Check for records that are treated as different by DNSSEC but are semantically equal in plain DNS. Possible modes are +Check for records that are treated as different by DNSSEC but are semantically equal in plain DNS\&. Possible modes are \fB"fail"\fR, \fB"warn"\fR (default) and -\fB"ignore"\fR. +\fB"ignore"\fR\&. .RE .PP \-s \fIstyle\fR .RS 4 -Specify the style of the dumped zone file. Possible styles are +Specify the style of the dumped zone file\&. Possible styles are \fB"full"\fR (default) and -\fB"relative"\fR. The full format is most suitable for processing automatically by a separate script. On the other hand, the relative format is more human\-readable and is thus suitable for editing by hand. For +\fB"relative"\fR\&. The full format is most suitable for processing automatically by a separate script\&. On the other hand, the relative format is more human\-readable and is thus suitable for editing by hand\&. For \fBnamed\-checkzone\fR -this does not cause any effects unless it dumps the zone contents. It also does not have any meaning if the output format is not text. +this does not cause any effects unless it dumps the zone contents\&. It also does not have any meaning if the output format is not text\&. .RE .PP \-S \fImode\fR .RS 4 -Check if a SRV record refers to a CNAME. Possible modes are +Check if a SRV record refers to a CNAME\&. Possible modes are \fB"fail"\fR, \fB"warn"\fR (default) and -\fB"ignore"\fR. +\fB"ignore"\fR\&. .RE .PP \-t \fIdirectory\fR .RS 4 Chroot to -\fIdirectory\fR -so that include directives in the configuration file are processed as if run by a similarly chrooted named. +directory +so that include directives in the configuration file are processed as if run by a similarly chrooted named\&. .RE .PP \-T \fImode\fR .RS 4 -Check if Sender Policy Framework (SPF) records exist and issues a warning if an SPF\-formatted TXT record is not also present. Possible modes are +Check if Sender Policy Framework (SPF) records exist and issues a warning if an SPF\-formatted TXT record is not also present\&. Possible modes are \fB"warn"\fR (default), -\fB"ignore"\fR. +\fB"ignore"\fR\&. .RE .PP \-w \fIdirectory\fR .RS 4 chdir to -\fIdirectory\fR -so that relative filenames in master file $INCLUDE directives work. This is similar to the directory clause in -\fInamed.conf\fR. +directory +so that relative filenames in master file $INCLUDE directives work\&. This is similar to the directory clause in +named\&.conf\&. .RE .PP \-D .RS 4 -Dump zone file in canonical format. This is always enabled for -\fBnamed\-compilezone\fR. +Dump zone file in canonical format\&. This is always enabled for +\fBnamed\-compilezone\fR\&. .RE .PP \-W \fImode\fR .RS 4 -Specify whether to check for non\-terminal wildcards. Non\-terminal wildcards are almost always the result of a failure to understand the wildcard matching algorithm (RFC 1034). Possible modes are +Specify whether to check for non\-terminal wildcards\&. Non\-terminal wildcards are almost always the result of a failure to understand the wildcard matching algorithm (RFC 1034)\&. Possible modes are \fB"warn"\fR (default) and -\fB"ignore"\fR. +\fB"ignore"\fR\&. .RE .PP zonename .RS 4 -The domain name of the zone being checked. +The domain name of the zone being checked\&. .RE .PP filename .RS 4 -The name of the zone file. +The name of the zone file\&. .RE .SH "RETURN VALUES" .PP \fBnamed\-checkzone\fR -returns an exit status of 1 if errors were detected and 0 otherwise. +returns an exit status of 1 if errors were detected and 0 otherwise\&. .SH "SEE ALSO" .PP \fBnamed\fR(8), -\fBnamed\-checkconf\fR(8), +\fBnamed-checkconf\fR(8), RFC 1035, -BIND 9 Administrator Reference Manual. +BIND 9 Administrator Reference Manual\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004\-2007, 2009\-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") .br -Copyright \(co 2000\-2002 Internet Software Consortium. +Copyright \(co 2004-2007, 2009-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2000-2002 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/check/named-checkzone.c b/contrib/bind9/bin/check/named-checkzone.c index b1b871d09..f731a1388 100644 --- a/contrib/bind9/bin/check/named-checkzone.c +++ b/contrib/bind9/bin/check/named-checkzone.c @@ -58,7 +58,7 @@ dns_zone_t *zone = NULL; dns_zonetype_t zonetype = dns_zone_master; static int dumpzone = 0; static const char *output_filename; -static char *prog_name = NULL; +static const char *prog_name = NULL; static const dns_master_style_t *outputstyle = NULL; static enum { progmode_check, progmode_compile } progmode; diff --git a/contrib/bind9/bin/check/named-checkzone.docbook b/contrib/bind9/bin/check/named-checkzone.docbook index f1590b554..31cd6a311 100644 --- a/contrib/bind9/bin/check/named-checkzone.docbook +++ b/contrib/bind9/bin/check/named-checkzone.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2013-04-29 + - April 29, 2013 + ISC + Internet Systems Consortium, Inc. @@ -40,6 +42,7 @@ 2011 2013 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -57,64 +60,64 @@ - + named-checkzone - - - - - - - - - - - - - - - - - - - - - - - - zonename - filename + + + + + + + + + + + + + + + + + + + + + + + + zonename + filename - + named-compilezone - - - - - - - - - - - - - - - - - - - - - - zonename - filename + + + + + + + + + + + + + + + + + + + + + + zonename + filename - - DESCRIPTION + DESCRIPTION + named-checkzone checks the syntax and integrity of a zone file. It performs the same checks as named does when loading a @@ -132,10 +135,10 @@ least be as strict as those specified in the named configuration file. - + + + OPTIONS - - OPTIONS @@ -289,7 +292,7 @@ -L serial - When compiling a zone to 'raw' format, set the "source serial" + When compiling a zone to 'raw' format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.) @@ -352,7 +355,7 @@ Check for records that are treated as different by DNSSEC but - are semantically equal in plain DNS. + are semantically equal in plain DNS. Possible modes are "fail", "warn" (default) and "ignore". @@ -473,37 +476,27 @@ - + + + RETURN VALUES - - RETURN VALUES named-checkzone returns an exit status of 1 if errors were detected and 0 otherwise. - + + + SEE ALSO - - SEE ALSO named8 , - named-checkconf8 + named-checkconf8 , RFC 1035, BIND 9 Administrator Reference Manual. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/check/named-checkzone.html b/contrib/bind9/bin/check/named-checkzone.html index 7d44053c2..ec0173d2b 100644 --- a/contrib/bind9/bin/check/named-checkzone.html +++ b/contrib/bind9/bin/check/named-checkzone.html @@ -1,5 +1,5 @@ - named-checkzone - + -
+

Name

@@ -32,29 +31,29 @@

named-checkzone [-d] [-h] [-j] [-q] [-v] [-c class] [-f format] [-F format] [-i mode] [-k mode] [-m mode] [-M mode] [-n mode] [-L serial] [-o filename] [-r mode] [-s style] [-S mode] [-t directory] [-T mode] [-w directory] [-D] [-W mode] {zonename} {filename}

named-compilezone [-d] [-j] [-q] [-v] [-c class] [-C mode] [-f format] [-F format] [-i mode] [-k mode] [-m mode] [-n mode] [-L serial] [-r mode] [-s style] [-t directory] [-T mode] [-w directory] [-D] [-W mode] {-o filename} {zonename} {filename}

-
-

DESCRIPTION

-

named-checkzone +

+

DESCRIPTION

+

named-checkzone checks the syntax and integrity of a zone file. It performs the - same checks as named does when loading a - zone. This makes named-checkzone useful for + same checks as named does when loading a + zone. This makes named-checkzone useful for checking zone files before configuring them into a name server.

- named-compilezone is similar to - named-checkzone, but it always dumps the + named-compilezone is similar to + named-checkzone, but it always dumps the zone contents to a specified file in a specified format. Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file - loaded by named. + loaded by named. When manually specified otherwise, the check levels must at least be as strict as those specified in the - named configuration file. + named configuration file.

-
-

OPTIONS

-
+
+

OPTIONS

+
-d

Enable debugging. @@ -69,7 +68,7 @@

-v

- Print the version of the named-checkzone + Print the version of the named-checkzone program and exit.

-j
@@ -84,133 +83,133 @@

Perform post-load zone integrity checks. Possible modes are - "full" (default), - "full-sibling", - "local", - "local-sibling" and - "none". + "full" (default), + "full-sibling", + "local", + "local-sibling" and + "none".

- Mode "full" checks that MX records + Mode "full" checks that MX records refer to A or AAAA record (both in-zone and out-of-zone - hostnames). Mode "local" only + hostnames). Mode "local" only checks MX records which refer to in-zone hostnames.

- Mode "full" checks that SRV records + Mode "full" checks that SRV records refer to A or AAAA record (both in-zone and out-of-zone - hostnames). Mode "local" only + hostnames). Mode "local" only checks SRV records which refer to in-zone hostnames.

- Mode "full" checks that delegation NS + Mode "full" checks that delegation NS records refer to A or AAAA record (both in-zone and out-of-zone hostnames). It also checks that glue address records in the zone match those advertised by the child. - Mode "local" only checks NS records which + Mode "local" only checks NS records which refer to in-zone hostnames or that some required glue exists, that is when the nameserver is in a child zone.

- Mode "full-sibling" and - "local-sibling" disable sibling glue - checks but are otherwise the same as "full" - and "local" respectively. + Mode "full-sibling" and + "local-sibling" disable sibling glue + checks but are otherwise the same as "full" + and "local" respectively.

- Mode "none" disables the checks. + Mode "none" disables the checks.

-f format

Specify the format of the zone file. - Possible formats are "text" (default) - and "raw". + Possible formats are "text" (default) + and "raw".

-F format

Specify the format of the output file specified. - For named-checkzone, + For named-checkzone, this does not cause any effects unless it dumps the zone contents.

- Possible formats are "text" (default) - and "raw" or "raw=N", + Possible formats are "text" (default) + and "raw" or "raw=N", which store the zone in a binary format for rapid loading - by named. "raw=N" + by named. "raw=N" specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of - named; if N is 1, the file can be read + named; if N is 1, the file can be read by release 9.9.0 or higher. The default is 1.

-k mode

- Perform "check-names" checks with the + Perform "check-names" checks with the specified failure mode. - Possible modes are "fail" - (default for named-compilezone), - "warn" - (default for named-checkzone) and - "ignore". + Possible modes are "fail" + (default for named-compilezone), + "warn" + (default for named-checkzone) and + "ignore".

-L serial

- When compiling a zone to 'raw' format, set the "source serial" + When compiling a zone to 'raw' format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.)

-m mode

Specify whether MX records should be checked to see if they - are addresses. Possible modes are "fail", - "warn" (default) and - "ignore". + are addresses. Possible modes are "fail", + "warn" (default) and + "ignore".

-M mode

Check if a MX record refers to a CNAME. - Possible modes are "fail", - "warn" (default) and - "ignore". + Possible modes are "fail", + "warn" (default) and + "ignore".

-n mode

Specify whether NS records should be checked to see if they are addresses. - Possible modes are "fail" - (default for named-compilezone), - "warn" - (default for named-checkzone) and - "ignore". + Possible modes are "fail" + (default for named-compilezone), + "warn" + (default for named-checkzone) and + "ignore".

-o filename

Write zone output to filename. If filename is - then write to standard out. - This is mandatory for named-compilezone. + This is mandatory for named-compilezone.

-r mode

Check for records that are treated as different by DNSSEC but - are semantically equal in plain DNS. - Possible modes are "fail", - "warn" (default) and - "ignore". + are semantically equal in plain DNS. + Possible modes are "fail", + "warn" (default) and + "ignore".

-s style

Specify the style of the dumped zone file. - Possible styles are "full" (default) - and "relative". + Possible styles are "full" (default) + and "relative". The full format is most suitable for processing automatically by a separate script. On the other hand, the relative format is more human-readable and is thus suitable for editing by hand. - For named-checkzone + For named-checkzone this does not cause any effects unless it dumps the zone contents. It also does not have any meaning if the output format @@ -219,9 +218,9 @@

-S mode

Check if a SRV record refers to a CNAME. - Possible modes are "fail", - "warn" (default) and - "ignore". + Possible modes are "fail", + "warn" (default) and + "ignore".

-t directory

@@ -234,8 +233,8 @@

Check if Sender Policy Framework (SPF) records exist and issues a warning if an SPF-formatted TXT record is - not also present. Possible modes are "warn" - (default), "ignore". + not also present. Possible modes are "warn" + (default), "ignore".

-w directory

@@ -248,16 +247,16 @@

-D

Dump zone file in canonical format. - This is always enabled for named-compilezone. + This is always enabled for named-compilezone.

-W mode

Specify whether to check for non-terminal wildcards. Non-terminal wildcards are almost always the result of a failure to understand the wildcard matching algorithm (RFC 1034). - Possible modes are "warn" (default) + Possible modes are "warn" (default) and - "ignore". + "ignore".

zonename

@@ -269,25 +268,20 @@

-
-

RETURN VALUES

-

named-checkzone +

+

RETURN VALUES

+

named-checkzone returns an exit status of 1 if errors were detected and 0 otherwise.

-
-

SEE ALSO

+
+

SEE ALSO

named(8), named-checkconf(8), RFC 1035, BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
diff --git a/contrib/bind9/bin/confgen/Makefile.in b/contrib/bind9/bin/confgen/Makefile.in index 8b3e5aa1c..205069e7e 100644 --- a/contrib/bind9/bin/confgen/Makefile.in +++ b/contrib/bind9/bin/confgen/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @BIND9_MAKE_INCLUDES@ @@ -74,11 +74,11 @@ rndc-confgen.@O@: rndc-confgen.c ddns-confgen.@O@: ddns-confgen.c ${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${srcdir}/ddns-confgen.c -rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS} +rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS} export BASEOBJS="rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS}"; \ ${FINALBUILDCMD} -ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS} +ddns-confgen@EXEEXT@: ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS} export BASEOBJS="ddns-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS}"; \ ${FINALBUILDCMD} diff --git a/contrib/bind9/bin/confgen/ddns-confgen.8 b/contrib/bind9/bin/confgen/ddns-confgen.8 index 5ceb80e96..aa40e4edc 100644 --- a/contrib/bind9/bin/confgen/ddns-confgen.8 +++ b/contrib/bind9/bin/confgen/ddns-confgen.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,26 +12,41 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: ddns\-confgen +'\" t +.\" Title: ddns-confgen .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: September 18, 2009 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2009-09-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "DDNS\-CONFGEN" "8" "September 18, 2009" "BIND9" "BIND9" +.TH "DDNS\-CONFGEN" "8" "2009\-09\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -ddns\-confgen \- ddns key generation tool +ddns-confgen \- ddns key generation tool .SH "SYNOPSIS" -.HP 13 +.HP \w'\fBddns\-confgen\fR\ 'u \fBddns\-confgen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [\-s\ \fIname\fR | \-z\ \fIzone\fR] [\fB\-q\fR] [name] .SH "DESCRIPTION" .PP @@ -39,46 +54,46 @@ ddns\-confgen \- ddns key generation tool generates a key for use by \fBnsupdate\fR and -\fBnamed\fR. It simplifies configuration of dynamic zones by generating a key and providing the +\fBnamed\fR\&. It simplifies configuration of dynamic zones by generating a key and providing the \fBnsupdate\fR and -\fBnamed.conf\fR +\fBnamed\&.conf\fR syntax that will be needed to use it, including an example \fBupdate\-policy\fR -statement. +statement\&. .PP If a domain name is specified on the command line, it will be used in the name of the generated key and in the sample -\fBnamed.conf\fR -syntax. For example, -\fBddns\-confgen example.com\fR -would generate a key called "ddns\-key.example.com", and sample -\fBnamed.conf\fR -command that could be used in the zone definition for "example.com". +\fBnamed\&.conf\fR +syntax\&. For example, +\fBddns\-confgen example\&.com\fR +would generate a key called "ddns\-key\&.example\&.com", and sample +\fBnamed\&.conf\fR +command that could be used in the zone definition for "example\&.com"\&. .PP Note that \fBnamed\fR itself can configure a local DDNS key for use with -\fBnsupdate \-l\fR. +\fBnsupdate \-l\fR\&. \fBddns\-confgen\fR is only needed when a more elaborate configuration is required: for instance, if \fBnsupdate\fR -is to be used from a remote system. +is to be used from a remote system\&. .SH "OPTIONS" .PP \-a \fIalgorithm\fR .RS 4 -Specifies the algorithm to use for the TSIG key. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512. The default is hmac\-sha256. +Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-sha256\&. .RE .PP \-h .RS 4 Prints a short summary of the options and arguments to -\fBddns\-confgen\fR. +\fBddns\-confgen\fR\&. .RE .PP \-k \fIkeyname\fR .RS 4 -Specifies the key name of the DDNS authentication key. The default is +Specifies the key name of the DDNS authentication key\&. The default is \fBddns\-key\fR when neither the \fB\-s\fR @@ -86,58 +101,59 @@ nor \fB\-z\fR option is specified; otherwise, the default is \fBddns\-key\fR -as a separate label followed by the argument of the option, e.g., -\fBddns\-key.example.com.\fR -The key name must have the format of a valid domain name, consisting of letters, digits, hyphens and periods. +as a separate label followed by the argument of the option, e\&.g\&., +\fBddns\-key\&.example\&.com\&.\fR +The key name must have the format of a valid domain name, consisting of letters, digits, hyphens and periods\&. .RE .PP \-q .RS 4 -Quiet mode: Print only the key, with no explanatory text or usage examples. +Quiet mode: Print only the key, with no explanatory text or usage examples\&. .RE .PP \-r \fIrandomfile\fR .RS 4 -Specifies a source of random data for generating the authorization. If the operating system does not provide a -\fI/dev/random\fR -or equivalent device, the default source of randomness is keyboard input. -\fIrandomdev\fR -specifies the name of a character device or file containing random data to be used instead of the default. The special value -\fIkeyboard\fR -indicates that keyboard input should be used. +Specifies a source of random data for generating the authorization\&. If the operating system does not provide a +/dev/random +or equivalent device, the default source of randomness is keyboard input\&. +randomdev +specifies the name of a character device or file containing random data to be used instead of the default\&. The special value +keyboard +indicates that keyboard input should be used\&. .RE .PP \-s \fIname\fR .RS 4 Single host mode: The example -\fBnamed.conf\fR +\fBnamed\&.conf\fR text shows how to set an update policy for the specified \fIname\fR -using the "name" nametype. The default key name is ddns\-key.\fIname\fR. Note that the "self" nametype cannot be used, since the name to be updated may differ from the key name. This option cannot be used with the +using the "name" nametype\&. The default key name is ddns\-key\&.\fIname\fR\&. Note that the "self" nametype cannot be used, since the name to be updated may differ from the key name\&. This option cannot be used with the \fB\-z\fR -option. +option\&. .RE .PP \-z \fIzone\fR .RS 4 zone mode: The example -\fBnamed.conf\fR +\fBnamed\&.conf\fR text shows how to set an update policy for the specified \fIzone\fR using the "zonesub" nametype, allowing updates to all subdomain names within that -\fIzone\fR. This option cannot be used with the +\fIzone\fR\&. This option cannot be used with the \fB\-s\fR -option. +option\&. .RE .SH "SEE ALSO" .PP \fBnsupdate\fR(1), \fBnamed.conf\fR(5), \fBnamed\fR(8), -BIND 9 Administrator Reference Manual. +BIND 9 Administrator Reference Manual\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/confgen/ddns-confgen.docbook b/contrib/bind9/bin/confgen/ddns-confgen.docbook index 1627c9ea0..44a640915 100644 --- a/contrib/bind9/bin/confgen/ddns-confgen.docbook +++ b/contrib/bind9/bin/confgen/ddns-confgen.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2009-09-18 + - September 18, 2009 + ISC + Internet Systems Consortium, Inc. @@ -37,28 +39,29 @@ 2009 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") - + ddns-confgen - - - - - - -s name - -z zone + + + + + + -s name + -z zone - - name + + name - - DESCRIPTION + DESCRIPTION + ddns-confgen generates a key for use by nsupdate and named. It simplifies configuration @@ -81,14 +84,14 @@ Note that named itself can configure a local DDNS key for use with nsupdate -l. - ddns-confgen is only needed when a + ddns-confgen is only needed when a more elaborate configuration is required: for instance, if nsupdate is to be used from a remote system. - + + + OPTIONS - - OPTIONS @@ -188,10 +191,10 @@ - + + + SEE ALSO - - SEE ALSO nsupdate1 , @@ -203,16 +206,6 @@ , BIND 9 Administrator Reference Manual. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/confgen/ddns-confgen.html b/contrib/bind9/bin/confgen/ddns-confgen.html index bdbd35ea0..025d6638b 100644 --- a/contrib/bind9/bin/confgen/ddns-confgen.html +++ b/contrib/bind9/bin/confgen/ddns-confgen.html @@ -1,5 +1,5 @@ - ddns-confgen - + -
+

Name

@@ -30,36 +29,36 @@

Synopsis

ddns-confgen [-a algorithm] [-h] [-k keyname] [-r randomfile] [ -s name | -z zone ] [-q] [name]

-
-

DESCRIPTION

-

ddns-confgen - generates a key for use by nsupdate - and named. It simplifies configuration +

+

DESCRIPTION

+

ddns-confgen + generates a key for use by nsupdate + and named. It simplifies configuration of dynamic zones by generating a key and providing the - nsupdate and named.conf + nsupdate and named.conf syntax that will be needed to use it, including an example - update-policy statement. + update-policy statement.

If a domain name is specified on the command line, it will be used in the name of the generated key and in the sample - named.conf syntax. For example, - ddns-confgen example.com would + named.conf syntax. For example, + ddns-confgen example.com would generate a key called "ddns-key.example.com", and sample - named.conf command that could be used + named.conf command that could be used in the zone definition for "example.com".

- Note that named itself can configure a - local DDNS key for use with nsupdate -l. - ddns-confgen is only needed when a + Note that named itself can configure a + local DDNS key for use with nsupdate -l. + ddns-confgen is only needed when a more elaborate configuration is required: for instance, if - nsupdate is to be used from a remote system. + nsupdate is to be used from a remote system.

-
-

OPTIONS

-
+
+

OPTIONS

+
-a algorithm

Specifies the algorithm to use for the TSIG key. Available @@ -69,7 +68,7 @@

-h

Prints a short summary of the options and arguments to - ddns-confgen. + ddns-confgen.

-k keyname

@@ -102,7 +101,7 @@

-s name

- Single host mode: The example named.conf text + Single host mode: The example named.conf text shows how to set an update policy for the specified name using the "name" nametype. @@ -114,7 +113,7 @@

-z zone

- zone mode: The example named.conf text + zone mode: The example named.conf text shows how to set an update policy for the specified zone using the "zonesub" nametype, allowing updates to all subdomain @@ -124,18 +123,13 @@

-
-

SEE ALSO

+
+

SEE ALSO

nsupdate(1), named.conf(5), named(8), BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
diff --git a/contrib/bind9/bin/confgen/rndc-confgen.8 b/contrib/bind9/bin/confgen/rndc-confgen.8 index 1276344e3..85d315100 100644 --- a/contrib/bind9/bin/confgen/rndc-confgen.8 +++ b/contrib/bind9/bin/confgen/rndc-confgen.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2001, 2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,58 +13,73 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: rndc\-confgen +'\" t +.\" Title: rndc-confgen .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 15, 2009 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2009-06-15 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "RNDC\-CONFGEN" "8" "June 15, 2009" "BIND9" "BIND9" +.TH "RNDC\-CONFGEN" "8" "2009\-06\-15" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -rndc\-confgen \- rndc key generation tool +rndc-confgen \- rndc key generation tool .SH "SYNOPSIS" -.HP 13 +.HP \w'\fBrndc\-confgen\fR\ 'u \fBrndc\-confgen\fR [\fB\-a\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-c\ \fR\fB\fIkeyfile\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [\fB\-s\ \fR\fB\fIaddress\fR\fR] [\fB\-t\ \fR\fB\fIchrootdir\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] .SH "DESCRIPTION" .PP \fBrndc\-confgen\fR generates configuration files for -\fBrndc\fR. It can be used as a convenient alternative to writing the -\fIrndc.conf\fR +\fBrndc\fR\&. It can be used as a convenient alternative to writing the +rndc\&.conf file and the corresponding \fBcontrols\fR and \fBkey\fR statements in -\fInamed.conf\fR -by hand. Alternatively, it can be run with the +named\&.conf +by hand\&. Alternatively, it can be run with the \fB\-a\fR option to set up a -\fIrndc.key\fR +rndc\&.key file and avoid the need for a -\fIrndc.conf\fR +rndc\&.conf file and a \fBcontrols\fR -statement altogether. +statement altogether\&. .SH "OPTIONS" .PP \-a .RS 4 Do automatic \fBrndc\fR -configuration. This creates a file -\fIrndc.key\fR +configuration\&. This creates a file +rndc\&.key in -\fI/etc\fR +/etc (or whatever \fIsysconfdir\fR was specified as when @@ -73,13 +88,13 @@ was built) that is read by both \fBrndc\fR and \fBnamed\fR -on startup. The -\fIrndc.key\fR +on startup\&. The +rndc\&.key file defines a default command channel and authentication key allowing \fBrndc\fR to communicate with \fBnamed\fR -on the local host with no further configuration. +on the local host with no further configuration\&. .sp Running \fBrndc\-confgen \-a\fR @@ -87,8 +102,8 @@ allows BIND 9 and \fBrndc\fR to be used as drop\-in replacements for BIND 8 and \fBndc\fR, with no changes to the existing BIND 8 -\fInamed.conf\fR -file. +named\&.conf +file\&. .sp If a more elaborate configuration than that generated by \fBrndc\-confgen \-a\fR @@ -97,15 +112,15 @@ is required, for example if rndc is to be used remotely, you should run without the \fB\-a\fR option and set up a -\fIrndc.conf\fR +rndc\&.conf and -\fInamed.conf\fR -as directed. +named\&.conf +as directed\&. .RE .PP \-b \fIkeysize\fR .RS 4 -Specifies the size of the authentication key in bits. Must be between 1 and 512 bits; the default is 128. +Specifies the size of the authentication key in bits\&. Must be between 1 and 512 bits; the default is 128\&. .RE .PP \-c \fIkeyfile\fR @@ -113,19 +128,19 @@ Specifies the size of the authentication key in bits. Must be between 1 and 512 Used with the \fB\-a\fR option to specify an alternate location for -\fIrndc.key\fR. +rndc\&.key\&. .RE .PP \-h .RS 4 Prints a short summary of the options and arguments to -\fBrndc\-confgen\fR. +\fBrndc\-confgen\fR\&. .RE .PP \-k \fIkeyname\fR .RS 4 -Specifies the key name of the rndc authentication key. This must be a valid domain name. The default is -\fBrndc\-key\fR. +Specifies the key name of the rndc authentication key\&. This must be a valid domain name\&. The default is +\fBrndc\-key\fR\&. .RE .PP \-p \fIport\fR @@ -133,18 +148,18 @@ Specifies the key name of the rndc authentication key. This must be a valid doma Specifies the command channel port where \fBnamed\fR listens for connections from -\fBrndc\fR. The default is 953. +\fBrndc\fR\&. The default is 953\&. .RE .PP \-r \fIrandomfile\fR .RS 4 -Specifies a source of random data for generating the authorization. If the operating system does not provide a -\fI/dev/random\fR -or equivalent device, the default source of randomness is keyboard input. -\fIrandomdev\fR -specifies the name of a character device or file containing random data to be used instead of the default. The special value -\fIkeyboard\fR -indicates that keyboard input should be used. +Specifies a source of random data for generating the authorization\&. If the operating system does not provide a +/dev/random +or equivalent device, the default source of randomness is keyboard input\&. +randomdev +specifies the name of a character device or file containing random data to be used instead of the default\&. The special value +keyboard +indicates that keyboard input should be used\&. .RE .PP \-s \fIaddress\fR @@ -152,7 +167,7 @@ indicates that keyboard input should be used. Specifies the IP address where \fBnamed\fR listens for command channel connections from -\fBrndc\fR. The default is the loopback address 127.0.0.1. +\fBrndc\fR\&. The default is the loopback address 127\&.0\&.0\&.1\&. .RE .PP \-t \fIchrootdir\fR @@ -161,10 +176,10 @@ Used with the \fB\-a\fR option to specify a directory where \fBnamed\fR -will run chrooted. An additional copy of the -\fIrndc.key\fR +will run chrooted\&. An additional copy of the +rndc\&.key will be written relative to this directory so that it will be found by the chrooted -\fBnamed\fR. +\fBnamed\fR\&. .RE .PP \-u \fIuser\fR @@ -172,10 +187,10 @@ will be written relative to this directory so that it will be found by the chroo Used with the \fB\-a\fR option to set the owner of the -\fIrndc.key\fR -file generated. If +rndc\&.key +file generated\&. If \fB\-t\fR -is also specified only the file in the chroot area has its owner changed. +is also specified only the file in the chroot area has its owner changed\&. .RE .SH "EXAMPLES" .PP @@ -186,13 +201,13 @@ to be used with no manual configuration, run \fBrndc\-confgen \-a\fR .PP To print a sample -\fIrndc.conf\fR +rndc\&.conf file and corresponding \fBcontrols\fR and \fBkey\fR statements to be manually inserted into -\fInamed.conf\fR, run +named\&.conf, run .PP \fBrndc\-confgen\fR .SH "SEE ALSO" @@ -200,12 +215,13 @@ statements to be manually inserted into \fBrndc\fR(8), \fBrndc.conf\fR(5), \fBnamed\fR(8), -BIND 9 Administrator Reference Manual. +BIND 9 Administrator Reference Manual\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2001, 2003 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/confgen/rndc-confgen.docbook b/contrib/bind9/bin/confgen/rndc-confgen.docbook index b3220754a..0887da2b5 100644 --- a/contrib/bind9/bin/confgen/rndc-confgen.docbook +++ b/contrib/bind9/bin/confgen/rndc-confgen.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2009-06-15 + - June 15, 2009 + ISC + Internet Systems Consortium, Inc. @@ -41,6 +43,7 @@ 2007 2009 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -51,23 +54,23 @@ - + rndc-confgen - - - - - - - - - - + + + + + + + + + + - - DESCRIPTION + DESCRIPTION + rndc-confgen generates configuration files for rndc. It can be used as a @@ -82,10 +85,10 @@ and a controls statement altogether. - + + + OPTIONS - - OPTIONS @@ -239,10 +242,10 @@ - + + + EXAMPLES - - EXAMPLES To allow rndc to be used with no manual configuration, run @@ -257,10 +260,10 @@ rndc-confgen - + + + SEE ALSO - - SEE ALSO rndc8 , @@ -272,16 +275,6 @@ , BIND 9 Administrator Reference Manual. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/confgen/rndc-confgen.html b/contrib/bind9/bin/confgen/rndc-confgen.html index 84eae417d..a5c02451d 100644 --- a/contrib/bind9/bin/confgen/rndc-confgen.html +++ b/contrib/bind9/bin/confgen/rndc-confgen.html @@ -1,5 +1,5 @@ - rndc-confgen - + -
+

Name

@@ -31,57 +30,57 @@

Synopsis

rndc-confgen [-a] [-b keysize] [-c keyfile] [-h] [-k keyname] [-p port] [-r randomfile] [-s address] [-t chrootdir] [-u user]

-
-

DESCRIPTION

-

rndc-confgen +

+

DESCRIPTION

+

rndc-confgen generates configuration files - for rndc. It can be used as a + for rndc. It can be used as a convenient alternative to writing the rndc.conf file - and the corresponding controls - and key + and the corresponding controls + and key statements in named.conf by hand. - Alternatively, it can be run with the -a + Alternatively, it can be run with the -a option to set up a rndc.key file and avoid the need for a rndc.conf file - and a controls statement altogether. + and a controls statement altogether.

-
-

OPTIONS

-
+
+

OPTIONS

+
-a

- Do automatic rndc configuration. + Do automatic rndc configuration. This creates a file rndc.key in /etc (or whatever sysconfdir was specified as when BIND was built) - that is read by both rndc - and named on startup. The + that is read by both rndc + and named on startup. The rndc.key file defines a default command channel and authentication key allowing - rndc to communicate with - named on the local host + rndc to communicate with + named on the local host with no further configuration.

- Running rndc-confgen -a allows - BIND 9 and rndc to be used as + Running rndc-confgen -a allows + BIND 9 and rndc to be used as drop-in - replacements for BIND 8 and ndc, + replacements for BIND 8 and ndc, with no changes to the existing BIND 8 named.conf file.

If a more elaborate configuration than that - generated by rndc-confgen -a + generated by rndc-confgen -a is required, for example if rndc is to be used remotely, - you should run rndc-confgen without + you should run rndc-confgen without the - -a option and set up a + -a option and set up a rndc.conf and named.conf as directed. @@ -94,13 +93,13 @@

-c keyfile

- Used with the -a option to specify + Used with the -a option to specify an alternate location for rndc.key.

-h

Prints a short summary of the options and arguments to - rndc-confgen. + rndc-confgen.

-k keyname

@@ -110,8 +109,8 @@

-p port

- Specifies the command channel port where named - listens for connections from rndc. + Specifies the command channel port where named + listens for connections from rndc. The default is 953.

-r randomfile
@@ -129,60 +128,55 @@

-s address

- Specifies the IP address where named + Specifies the IP address where named listens for command channel connections from - rndc. The default is the loopback + rndc. The default is the loopback address 127.0.0.1.

-t chrootdir

- Used with the -a option to specify - a directory where named will run + Used with the -a option to specify + a directory where named will run chrooted. An additional copy of the rndc.key will be written relative to this directory so that - it will be found by the chrooted named. + it will be found by the chrooted named.

-u user

- Used with the -a option to set the + Used with the -a option to set the owner of the rndc.key file generated. If - -t is also specified only the file + -t is also specified only the file in the chroot area has its owner changed.

-
-

EXAMPLES

+
+

EXAMPLES

- To allow rndc to be used with + To allow rndc to be used with no manual configuration, run

rndc-confgen -a

To print a sample rndc.conf file and - corresponding controls and key + corresponding controls and key statements to be manually inserted into named.conf, run

rndc-confgen

-
-

SEE ALSO

+
+

SEE ALSO

rndc(8), rndc.conf(5), named(8), BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
diff --git a/contrib/bind9/bin/dig/Makefile.in b/contrib/bind9/bin/dig/Makefile.in index 5bc4db0a3..f70531275 100644 --- a/contrib/bind9/bin/dig/Makefile.in +++ b/contrib/bind9/bin/dig/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2005, 2007, 2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2005, 2007, 2009, 2012, 2013, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000-2002 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @BIND9_MAKE_INCLUDES@ diff --git a/contrib/bind9/bin/dig/dig.1 b/contrib/bind9/bin/dig/dig.1 index f78d556bf..380dba101 100644 --- a/contrib/bind9/bin/dig/dig.1 +++ b/contrib/bind9/bin/dig/dig.1 @@ -13,145 +13,164 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: dig .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: February 12, 2014 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2014-02-12 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "DIG" "1" "February 12, 2014" "BIND9" "BIND9" +.TH "DIG" "1" "2014\-02\-12" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" dig \- DNS lookup utility .SH "SYNOPSIS" -.HP 4 +.HP \w'\fBdig\fR\ 'u \fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-m\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIname:key\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [name] [type] [class] [queryopt...] -.HP 4 +.HP \w'\fBdig\fR\ 'u \fBdig\fR [\fB\-h\fR] -.HP 4 +.HP \w'\fBdig\fR\ 'u \fBdig\fR [global\-queryopt...] [query...] .SH "DESCRIPTION" .PP \fBdig\fR -(domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried. Most DNS administrators use +(domain information groper) is a flexible tool for interrogating DNS name servers\&. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried\&. Most DNS administrators use \fBdig\fR -to troubleshoot DNS problems because of its flexibility, ease of use and clarity of output. Other lookup tools tend to have less functionality than -\fBdig\fR. +to troubleshoot DNS problems because of its flexibility, ease of use and clarity of output\&. Other lookup tools tend to have less functionality than +\fBdig\fR\&. .PP Although \fBdig\fR -is normally used with command\-line arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command\-line arguments and options is printed when the +is normally used with command\-line arguments, it also has a batch mode of operation for reading lookup requests from a file\&. A brief summary of its command\-line arguments and options is printed when the \fB\-h\fR -option is given. Unlike earlier versions, the BIND 9 implementation of +option is given\&. Unlike earlier versions, the BIND 9 implementation of \fBdig\fR -allows multiple lookups to be issued from the command line. +allows multiple lookups to be issued from the command line\&. .PP Unless it is told to query a specific name server, \fBdig\fR will try each of the servers listed in -\fI/etc/resolv.conf\fR. If no usable server addresses are found, +/etc/resolv\&.conf\&. If no usable server addresses are found, \fBdig\fR -will send the query to the local host. +will send the query to the local host\&. .PP When no command line arguments or options are given, \fBdig\fR -will perform an NS query for "." (the root). +will perform an NS query for "\&." (the root)\&. .PP It is possible to set per\-user defaults for \fBdig\fR via -\fI${HOME}/.digrc\fR. This file is read and any options in it are applied before the command line arguments. +${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&. .PP -The IN and CH class names overlap with the IN and CH top level domain names. Either use the +The IN and CH class names overlap with the IN and CH top level domain names\&. Either use the \fB\-t\fR and \fB\-c\fR options to specify the type and class, use the \fB\-q\fR -the specify the domain name, or use "IN." and "CH." when looking up these top level domains. +the specify the domain name, or use "IN\&." and "CH\&." when looking up these top level domains\&. .SH "SIMPLE USAGE" .PP A typical invocation of \fBdig\fR looks like: .sp +.if n \{\ .RS 4 +.\} .nf dig @server name type .fi +.if n \{\ .RE +.\} .sp where: .PP \fBserver\fR .RS 4 -is the name or IP address of the name server to query. This can be an IPv4 address in dotted\-decimal notation or an IPv6 address in colon\-delimited notation. When the supplied +is the name or IP address of the name server to query\&. This can be an IPv4 address in dotted\-decimal notation or an IPv6 address in colon\-delimited notation\&. When the supplied \fIserver\fR argument is a hostname, \fBdig\fR -resolves that name before querying that name server. +resolves that name before querying that name server\&. .sp If no \fIserver\fR argument is provided, \fBdig\fR consults -\fI/etc/resolv.conf\fR; if an address is found there, it queries the name server at that address. If either of the +/etc/resolv\&.conf; if an address is found there, it queries the name server at that address\&. If either of the \fB\-4\fR or \fB\-6\fR -options are in use, then only addresses for the corresponding transport will be tried. If no usable addresses are found, +options are in use, then only addresses for the corresponding transport will be tried\&. If no usable addresses are found, \fBdig\fR -will send the query to the local host. The reply from the name server that responds is displayed. +will send the query to the local host\&. The reply from the name server that responds is displayed\&. .RE .PP \fBname\fR .RS 4 -is the name of the resource record that is to be looked up. +is the name of the resource record that is to be looked up\&. .RE .PP \fBtype\fR .RS 4 -indicates what type of query is required \(em ANY, A, MX, SIG, etc. +indicates what type of query is required \(em ANY, A, MX, SIG, etc\&. \fItype\fR -can be any valid query type. If no +can be any valid query type\&. If no \fItype\fR argument is supplied, \fBdig\fR -will perform a lookup for an A record. +will perform a lookup for an A record\&. .RE .SH "OPTIONS" .PP \-4 .RS 4 -Use IPv4 only. +Use IPv4 only\&. .RE .PP \-6 .RS 4 -Use IPv6 only. +Use IPv6 only\&. .RE .PP \-b \fIaddress\fR\fI[#port]\fR .RS 4 -Set the source IP address of the query. The +Set the source IP address of the query\&. The \fIaddress\fR -must be a valid address on one of the host's network interfaces, or "0.0.0.0" or "::". An optional port may be specified by appending "#" +must be a valid address on one of the host\*(Aqs network interfaces, or "0\&.0\&.0\&.0" or "::"\&. An optional port may be specified by appending "#" .RE .PP \-c \fIclass\fR .RS 4 -Set the query class. The default +Set the query class\&. The default \fIclass\fR -is IN; other classes are HS for Hesiod records or CH for Chaosnet records. +is IN; other classes are HS for Hesiod records or CH for Chaosnet records\&. .RE .PP \-f \fIfile\fR @@ -159,88 +178,88 @@ is IN; other classes are HS for Hesiod records or CH for Chaosnet records. Batch mode: \fBdig\fR reads a list of lookup requests to process from the given -\fIfile\fR. Each line in the file should be organized in the same way they would be presented as queries to +\fIfile\fR\&. Each line in the file should be organized in the same way they would be presented as queries to \fBdig\fR -using the command\-line interface. +using the command\-line interface\&. .RE .PP \-i .RS 4 -Do reverse IPv6 lookups using the obsolete RFC1886 IP6.INT domain, which is no longer in use. Obsolete bit string label queries (RFC2874) are not attempted. +Do reverse IPv6 lookups using the obsolete RFC1886 IP6\&.INT domain, which is no longer in use\&. Obsolete bit string label queries (RFC2874) are not attempted\&. .RE .PP \-k \fIkeyfile\fR .RS 4 -Sign queries using TSIG using a key read from the given file. Key files can be generated using -\fBtsig\-keygen\fR(8). When using TSIG authentication with -\fBdig\fR, the name server that is queried needs to know the key and algorithm that is being used. In BIND, this is done by providing appropriate +Sign queries using TSIG using a key read from the given file\&. Key files can be generated using +\fBtsig-keygen\fR(8)\&. When using TSIG authentication with +\fBdig\fR, the name server that is queried needs to know the key and algorithm that is being used\&. In BIND, this is done by providing appropriate \fBkey\fR and \fBserver\fR statements in -\fInamed.conf\fR. +named\&.conf\&. .RE .PP \-m .RS 4 -Enable memory usage debugging. +Enable memory usage debugging\&. .RE .PP \-p \fIport\fR .RS 4 -Send the query to a non\-standard port on the server, instead of the defaut port 53. This option would be used to test a name server that has been configured to listen for queries on a non\-standard port number. +Send the query to a non\-standard port on the server, instead of the defaut port 53\&. This option would be used to test a name server that has been configured to listen for queries on a non\-standard port number\&. .RE .PP \-q \fIname\fR .RS 4 -The domain name to query. This is useful to distinguish the +The domain name to query\&. This is useful to distinguish the \fIname\fR -from other arguments. +from other arguments\&. .RE .PP \-t \fItype\fR .RS 4 -The resource record type to query. It can be any valid query type which is supported in BIND 9. The default query type is "A", unless the +The resource record type to query\&. It can be any valid query type which is supported in BIND 9\&. The default query type is "A", unless the \fB\-x\fR -option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required, set the +option is supplied to indicate a reverse lookup\&. A zone transfer can be requested by specifying a type of AXFR\&. When an incremental zone transfer (IXFR) is required, set the \fItype\fR to -ixfr=N. The incremental zone transfer will contain the changes made to the zone since the serial number in the zone's SOA record was -\fIN\fR. +ixfr=N\&. The incremental zone transfer will contain the changes made to the zone since the serial number in the zone\*(Aqs SOA record was +\fIN\fR\&. .RE .PP \-v .RS 4 -Print the version number and exit. +Print the version number and exit\&. .RE .PP \-x \fIaddr\fR .RS 4 -Simplified reverse lookups, for mapping addresses to names. The +Simplified reverse lookups, for mapping addresses to names\&. The \fIaddr\fR -is an IPv4 address in dotted\-decimal notation, or a colon\-delimited IPv6 address. When the +is an IPv4 address in dotted\-decimal notation, or a colon\-delimited IPv6 address\&. When the \fB\-x\fR is used, there is no need to provide the \fIname\fR, \fIclass\fR and \fItype\fR -arguments. +arguments\&. \fBdig\fR automatically performs a lookup for a name like -94.2.0.192.in\-addr.arpa -and sets the query type and class to PTR and IN respectively. IPv6 addresses are looked up using nibble format under the IP6.ARPA domain (but see also the +94\&.2\&.0\&.192\&.in\-addr\&.arpa +and sets the query type and class to PTR and IN respectively\&. IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain (but see also the \fB\-i\fR -option). +option)\&. .RE .PP \-y \fI[hmac:]\fR\fIkeyname:secret\fR .RS 4 -Sign queries using TSIG with the given authentication key. +Sign queries using TSIG with the given authentication key\&. \fIkeyname\fR is the name of the key, and \fIsecret\fR -is the base64 encoded shared secret. +is the base64 encoded shared secret\&. \fIhmac\fR is the name of the key algorithm; valid choices are hmac\-md5, @@ -248,10 +267,10 @@ hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384, or -hmac\-sha512. If +hmac\-sha512\&. If \fIhmac\fR is not specified, the default is -hmac\-md5. +hmac\-md5\&. .sp NOTE: You should use the \fB\-k\fR @@ -259,91 +278,91 @@ option and avoid the \fB\-y\fR option, because with \fB\-y\fR -the shared secret is supplied as a command line argument in clear text. This may be visible in the output from +the shared secret is supplied as a command line argument in clear text\&. This may be visible in the output from \fBps\fR(1) -or in a history file maintained by the user's shell. +or in a history file maintained by the user\*(Aqs shell\&. .RE .SH "QUERY OPTIONS" .PP \fBdig\fR -provides a number of query options which affect the way in which lookups are made and the results displayed. Some of these set or reset flag bits in the query header, some determine which sections of the answer get printed, and others determine the timeout and retry strategies. +provides a number of query options which affect the way in which lookups are made and the results displayed\&. Some of these set or reset flag bits in the query header, some determine which sections of the answer get printed, and others determine the timeout and retry strategies\&. .PP -Each query option is identified by a keyword preceded by a plus sign (+). Some keywords set or reset an option. These may be preceded by the string +Each query option is identified by a keyword preceded by a plus sign (+)\&. Some keywords set or reset an option\&. These may be preceded by the string no -to negate the meaning of that keyword. Other keywords assign values to options like the timeout interval. They have the form -\fB+keyword=value\fR. Keywords may be abbreviated, provided the abbreviation is unambiguous; for example, +to negate the meaning of that keyword\&. Other keywords assign values to options like the timeout interval\&. They have the form +\fB+keyword=value\fR\&. Keywords may be abbreviated, provided the abbreviation is unambiguous; for example, +cd is equivalent to -+cdflag. The query options are: ++cdflag\&. The query options are: .PP \fB+[no]aaflag\fR .RS 4 A synonym for -\fI+[no]aaonly\fR. +\fI+[no]aaonly\fR\&. .RE .PP \fB+[no]aaonly\fR .RS 4 -Sets the "aa" flag in the query. +Sets the "aa" flag in the query\&. .RE .PP \fB+[no]additional\fR .RS 4 -Display [do not display] the additional section of a reply. The default is to display it. +Display [do not display] the additional section of a reply\&. The default is to display it\&. .RE .PP \fB+[no]adflag\fR .RS 4 -Set [do not set] the AD (authentic data) bit in the query. This requests the server to return whether all of the answer and authority sections have all been validated as secure according to the security policy of the server. AD=1 indicates that all records have been validated as secure and the answer is not from a OPT\-OUT range. AD=0 indicate that some part of the answer was insecure or not validated. This bit is set by default. +Set [do not set] the AD (authentic data) bit in the query\&. This requests the server to return whether all of the answer and authority sections have all been validated as secure according to the security policy of the server\&. AD=1 indicates that all records have been validated as secure and the answer is not from a OPT\-OUT range\&. AD=0 indicate that some part of the answer was insecure or not validated\&. This bit is set by default\&. .RE .PP \fB+[no]all\fR .RS 4 -Set or clear all display flags. +Set or clear all display flags\&. .RE .PP \fB+[no]answer\fR .RS 4 -Display [do not display] the answer section of a reply. The default is to display it. +Display [do not display] the answer section of a reply\&. The default is to display it\&. .RE .PP \fB+[no]authority\fR .RS 4 -Display [do not display] the authority section of a reply. The default is to display it. +Display [do not display] the authority section of a reply\&. The default is to display it\&. .RE .PP \fB+[no]besteffort\fR .RS 4 -Attempt to display the contents of messages which are malformed. The default is to not display malformed answers. +Attempt to display the contents of messages which are malformed\&. The default is to not display malformed answers\&. .RE .PP \fB+bufsize=B\fR .RS 4 Set the UDP message buffer size advertised using EDNS0 to \fIB\fR -bytes. The maximum and minimum sizes of this buffer are 65535 and 0 respectively. Values outside this range are rounded up or down appropriately. Values other than zero will cause a EDNS query to be sent. +bytes\&. The maximum and minimum sizes of this buffer are 65535 and 0 respectively\&. Values outside this range are rounded up or down appropriately\&. Values other than zero will cause a EDNS query to be sent\&. .RE .PP \fB+[no]cdflag\fR .RS 4 -Set [do not set] the CD (checking disabled) bit in the query. This requests the server to not perform DNSSEC validation of responses. +Set [do not set] the CD (checking disabled) bit in the query\&. This requests the server to not perform DNSSEC validation of responses\&. .RE .PP \fB+[no]class\fR .RS 4 -Display [do not display] the CLASS when printing the record. +Display [do not display] the CLASS when printing the record\&. .RE .PP \fB+[no]cmd\fR .RS 4 Toggles the printing of the initial comment in the output identifying the version of \fBdig\fR -and the query options that have been applied. This comment is printed by default. +and the query options that have been applied\&. This comment is printed by default\&. .RE .PP \fB+[no]comments\fR .RS 4 -Toggle the display of comment lines in the output. The default is to print comments. +Toggle the display of comment lines in the output\&. The default is to print comments\&. .RE .PP \fB+[no]defname\fR @@ -354,7 +373,7 @@ Deprecated, treated as a synonym for .PP \fB+[no]dnssec\fR .RS 4 -Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO) in the OPT record in the additional section of the query. +Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO) in the OPT record in the additional section of the query\&. .RE .PP \fB+domain=somename\fR @@ -363,46 +382,46 @@ Set the search list to contain the single domain \fIsomename\fR, as if specified in a \fBdomain\fR directive in -\fI/etc/resolv.conf\fR, and enable search list processing as if the +/etc/resolv\&.conf, and enable search list processing as if the \fI+search\fR -option were given. +option were given\&. .RE .PP \fB+[no]edns[=#]\fR .RS 4 -Specify the EDNS version to query with. Valid values are 0 to 255. Setting the EDNS version will cause a EDNS query to be sent. +Specify the EDNS version to query with\&. Valid values are 0 to 255\&. Setting the EDNS version will cause a EDNS query to be sent\&. \fB+noedns\fR -clears the remembered EDNS version. EDNS is set to 0 by default. +clears the remembered EDNS version\&. EDNS is set to 0 by default\&. .RE .PP \fB+[no]fail\fR .RS 4 -Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behavior. +Do not try the next server if you receive a SERVFAIL\&. The default is to not try the next server which is the reverse of normal stub resolver behavior\&. .RE .PP \fB+[no]identify\fR .RS 4 Show [or do not show] the IP address and port number that supplied the answer when the \fI+short\fR -option is enabled. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer. +option is enabled\&. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer\&. .RE .PP \fB+[no]ignore\fR .RS 4 -Ignore truncation in UDP responses instead of retrying with TCP. By default, TCP retries are performed. +Ignore truncation in UDP responses instead of retrying with TCP\&. By default, TCP retries are performed\&. .RE .PP \fB+[no]keepopen\fR .RS 4 -Keep the TCP socket open between queries and reuse it rather than creating a new TCP socket for each lookup. The default is -\fB+nokeepopen\fR. +Keep the TCP socket open between queries and reuse it rather than creating a new TCP socket for each lookup\&. The default is +\fB+nokeepopen\fR\&. .RE .PP \fB+[no]multiline\fR .RS 4 -Print records like the SOA records in a verbose multi\-line format with human\-readable comments. The default is to print each record on a single line, to facilitate machine parsing of the +Print records like the SOA records in a verbose multi\-line format with human\-readable comments\&. The default is to print each record on a single line, to facilitate machine parsing of the \fBdig\fR -output. +output\&. .RE .PP \fB+ndots=D\fR @@ -411,101 +430,101 @@ Set the number of dots that have to appear in \fIname\fR to \fID\fR -for it to be considered absolute. The default value is that defined using the ndots statement in -\fI/etc/resolv.conf\fR, or 1 if no ndots statement is present. Names with fewer dots are interpreted as relative names and will be searched for in the domains listed in the +for it to be considered absolute\&. The default value is that defined using the ndots statement in +/etc/resolv\&.conf, or 1 if no ndots statement is present\&. Names with fewer dots are interpreted as relative names and will be searched for in the domains listed in the \fBsearch\fR or \fBdomain\fR directive in -\fI/etc/resolv.conf\fR +/etc/resolv\&.conf if \fB+search\fR -is set. +is set\&. .RE .PP \fB+[no]nsid\fR .RS 4 -Include an EDNS name server ID request when sending a query. +Include an EDNS name server ID request when sending a query\&. .RE .PP \fB+[no]nssearch\fR .RS 4 When this option is set, \fBdig\fR -attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone. +attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone\&. .RE .PP \fB+[no]onesoa\fR .RS 4 -Print only one (starting) SOA record when performing an AXFR. The default is to print both the starting and ending SOA records. +Print only one (starting) SOA record when performing an AXFR\&. The default is to print both the starting and ending SOA records\&. .RE .PP \fB+[no]qr\fR .RS 4 -Print [do not print] the query as it is sent. By default, the query is not printed. +Print [do not print] the query as it is sent\&. By default, the query is not printed\&. .RE .PP \fB+[no]question\fR .RS 4 -Print [do not print] the question section of a query when an answer is returned. The default is to print the question section as a comment. +Print [do not print] the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&. .RE .PP \fB+[no]rdflag\fR .RS 4 A synonym for -\fI+[no]recurse\fR. +\fI+[no]recurse\fR\&. .RE .PP \fB+[no]recurse\fR .RS 4 -Toggle the setting of the RD (recursion desired) bit in the query. This bit is set by default, which means +Toggle the setting of the RD (recursion desired) bit in the query\&. This bit is set by default, which means \fBdig\fR -normally sends recursive queries. Recursion is automatically disabled when the +normally sends recursive queries\&. Recursion is automatically disabled when the \fI+nssearch\fR or \fI+trace\fR -query options are used. +query options are used\&. .RE .PP \fB+retry=T\fR .RS 4 Sets the number of times to retry UDP queries to server to \fIT\fR -instead of the default, 2. Unlike -\fI+tries\fR, this does not include the initial query. +instead of the default, 2\&. Unlike +\fI+tries\fR, this does not include the initial query\&. .RE .PP \fB+[no]rrcomments\fR .RS 4 -Toggle the display of per\-record comments in the output (for example, human\-readable key information about DNSKEY records). The default is not to print record comments unless multiline mode is active. +Toggle the display of per\-record comments in the output (for example, human\-readable key information about DNSKEY records)\&. The default is not to print record comments unless multiline mode is active\&. .RE .PP \fB+[no]search\fR .RS 4 Use [do not use] the search list defined by the searchlist or domain directive in -\fIresolv.conf\fR -(if any). The search list is not used by default. +resolv\&.conf +(if any)\&. The search list is not used by default\&. .sp -\'ndots' from -\fIresolv.conf\fR +\*(Aqndots\*(Aq from +resolv\&.conf (default 1) which may be overridden by \fI+ndots\fR -determines if the name will be treated as relative or not and hence whether a search is eventually performed or not. +determines if the name will be treated as relative or not and hence whether a search is eventually performed or not\&. .RE .PP \fB+[no]short\fR .RS 4 -Provide a terse answer. The default is to print the answer in a verbose form. +Provide a terse answer\&. The default is to print the answer in a verbose form\&. .RE .PP \fB+[no]showsearch\fR .RS 4 -Perform [do not perform] a search showing intermediate results. +Perform [do not perform] a search showing intermediate results\&. .RE .PP \fB+[no]sigchase\fR .RS 4 -Chase DNSSEC signature chains. Requires dig be compiled with \-DDIG_SIGCHASE. +Chase DNSSEC signature chains\&. Requires dig be compiled with \-DDIG_SIGCHASE\&. .RE .PP \fB+split=W\fR @@ -514,86 +533,86 @@ Split long hex\- or base64\-formatted fields in resource records into chunks of \fIW\fR characters (where \fIW\fR -is rounded up to the nearest multiple of 4). +is rounded up to the nearest multiple of 4)\&. \fI+nosplit\fR or \fI+split=0\fR -causes fields not to be split at all. The default is 56 characters, or 44 characters when multiline mode is active. +causes fields not to be split at all\&. The default is 56 characters, or 44 characters when multiline mode is active\&. .RE .PP \fB+[no]stats\fR .RS 4 -This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behavior is to print the query statistics. +This query option toggles the printing of statistics: when the query was made, the size of the reply and so on\&. The default behavior is to print the query statistics\&. .RE .PP \fB+[no]tcp\fR .RS 4 -Use [do not use] TCP when querying name servers. The default behavior is to use UDP unless an +Use [do not use] TCP when querying name servers\&. The default behavior is to use UDP unless an ixfr=N -query is requested, in which case the default is TCP. AXFR queries always use TCP. +query is requested, in which case the default is TCP\&. AXFR queries always use TCP\&. .RE .PP \fB+time=T\fR .RS 4 Sets the timeout for a query to \fIT\fR -seconds. The default timeout is 5 seconds. An attempt to set +seconds\&. The default timeout is 5 seconds\&. An attempt to set \fIT\fR -to less than 1 will result in a query timeout of 1 second being applied. +to less than 1 will result in a query timeout of 1 second being applied\&. .RE .PP \fB+[no]topdown\fR .RS 4 -When chasing DNSSEC signature chains perform a top\-down validation. Requires dig be compiled with \-DDIG_SIGCHASE. +When chasing DNSSEC signature chains perform a top\-down validation\&. Requires dig be compiled with \-DDIG_SIGCHASE\&. .RE .PP \fB+[no]trace\fR .RS 4 -Toggle tracing of the delegation path from the root name servers for the name being looked up. Tracing is disabled by default. When tracing is enabled, +Toggle tracing of the delegation path from the root name servers for the name being looked up\&. Tracing is disabled by default\&. When tracing is enabled, \fBdig\fR -makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup. +makes iterative queries to resolve the name being looked up\&. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup\&. .sp -If @server is also specified, it affects only the initial query for the root zone name servers. +If @server is also specified, it affects only the initial query for the root zone name servers\&. .sp \fB+dnssec\fR -is also set when +trace is set to better emulate the default queries from a nameserver. +is also set when +trace is set to better emulate the default queries from a nameserver\&. .RE .PP \fB+tries=T\fR .RS 4 Sets the number of times to try UDP queries to server to \fIT\fR -instead of the default, 3. If +instead of the default, 3\&. If \fIT\fR -is less than or equal to zero, the number of tries is silently rounded up to 1. +is less than or equal to zero, the number of tries is silently rounded up to 1\&. .RE .PP \fB+trusted\-key=####\fR .RS 4 Specifies a file containing trusted keys to be used with -\fB+sigchase\fR. Each DNSKEY record must be on its own line. +\fB+sigchase\fR\&. Each DNSKEY record must be on its own line\&. .sp If not specified, \fBdig\fR will look for -\fI/etc/trusted\-key.key\fR +/etc/trusted\-key\&.key then -\fItrusted\-key.key\fR -in the current directory. +trusted\-key\&.key +in the current directory\&. .sp -Requires dig be compiled with \-DDIG_SIGCHASE. +Requires dig be compiled with \-DDIG_SIGCHASE\&. .RE .PP \fB+[no]ttlid\fR .RS 4 -Display [do not display] the TTL when printing the record. +Display [do not display] the TTL when printing the record\&. .RE .PP \fB+[no]vc\fR .RS 4 -Use [do not use] TCP when querying name servers. This alternate syntax to +Use [do not use] TCP when querying name servers\&. This alternate syntax to \fI+[no]tcp\fR -is provided for backwards compatibility. The "vc" stands for "virtual circuit". +is provided for backwards compatibility\&. The "vc" stands for "virtual circuit"\&. .RE .SH "MULTIPLE QUERIES" .PP @@ -601,63 +620,71 @@ The BIND 9 implementation of \fBdig \fR supports specifying multiple queries on the command line (in addition to supporting the \fB\-f\fR -batch file option). Each of those queries can be supplied with its own set of flags, options and query options. +batch file option)\&. Each of those queries can be supplied with its own set of flags, options and query options\&. .PP In this case, each \fIquery\fR -argument represent an individual query in the command\-line syntax described above. Each consists of any of the standard options and flags, the name to be looked up, an optional query type and class and any query options that should be applied to that query. +argument represent an individual query in the command\-line syntax described above\&. Each consists of any of the standard options and flags, the name to be looked up, an optional query type and class and any query options that should be applied to that query\&. .PP -A global set of query options, which should be applied to all queries, can also be supplied. These global query options must precede the first tuple of name, class, type, options, flags, and query options supplied on the command line. Any global query options (except the +A global set of query options, which should be applied to all queries, can also be supplied\&. These global query options must precede the first tuple of name, class, type, options, flags, and query options supplied on the command line\&. Any global query options (except the \fB+[no]cmd\fR -option) can be overridden by a query\-specific set of query options. For example: +option) can be overridden by a query\-specific set of query options\&. For example: .sp +.if n \{\ .RS 4 +.\} .nf -dig +qr www.isc.org any \-x 127.0.0.1 isc.org ns +noqr +dig +qr www\&.isc\&.org any \-x 127\&.0\&.0\&.1 isc\&.org ns +noqr .fi +.if n \{\ .RE +.\} .sp shows how \fBdig\fR could be used from the command line to make three lookups: an ANY query for -www.isc.org, a reverse lookup of 127.0.0.1 and a query for the NS records of -isc.org. A global query option of +www\&.isc\&.org, a reverse lookup of 127\&.0\&.0\&.1 and a query for the NS records of +isc\&.org\&. A global query option of \fI+qr\fR is applied, so that \fBdig\fR -shows the initial query it made for each lookup. The final query has a local query option of +shows the initial query it made for each lookup\&. The final query has a local query option of \fI+noqr\fR which means that \fBdig\fR will not print the initial query when it looks up the NS records for -isc.org. +isc\&.org\&. .SH "IDN SUPPORT" .PP If \fBdig\fR -has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names. +has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&. \fBdig\fR -appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server. If you'd like to turn off the IDN support for some reason, defines the +appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, defines the \fBIDN_DISABLE\fR -environment variable. The IDN support is disabled if the variable is set when +environment variable\&. The IDN support is disabled if the variable is set when \fBdig\fR -runs. +runs\&. .SH "FILES" .PP -\fI/etc/resolv.conf\fR +/etc/resolv\&.conf .PP -\fI${HOME}/.digrc\fR +${HOME}/\&.digrc .SH "SEE ALSO" .PP \fBhost\fR(1), \fBnamed\fR(8), -\fBdnssec\-keygen\fR(8), -RFC1035. +\fBdnssec-keygen\fR(8), +RFC1035\&. .SH "BUGS" .PP -There are probably too many query options. +There are probably too many query options\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004\-2011, 2013\-2015 Internet Systems Consortium, Inc. ("ISC") .br -Copyright \(co 2000\-2003 Internet Software Consortium. +Copyright \(co 2004-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2000-2003 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/dig/dig.c b/contrib/bind9/bin/dig/dig.c index 145e6107a..d5f872dd3 100644 --- a/contrib/bind9/bin/dig/dig.c +++ b/contrib/bind9/bin/dig/dig.c @@ -67,9 +67,12 @@ static char domainopt[DNS_NAME_MAXTEXT]; static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE, ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE, multiline = ISC_FALSE, nottl = ISC_FALSE, noclass = ISC_FALSE, - onesoa = ISC_FALSE, rrcomments = ISC_FALSE; + onesoa = ISC_FALSE; static isc_uint32_t splitwidth = 0xffffffff; +/*% rrcomments are neither explicitly enabled nor disabled by default */ +static int rrcomments = 0; + /*% opcode text */ static const char * const opcodetext[] = { "QUERY", @@ -319,7 +322,8 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) { ADD_STRING(buf, " "); } - if (rrcomments) + /* Turn on rrcomments if explicitly enabled */ + if (rrcomments > 0) styleflags |= DNS_STYLEFLAG_RRCOMMENT; result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0, splitwidth, " ", buf); @@ -404,7 +408,8 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset, styleflags |= DNS_STYLEFLAG_NO_TTL; if (noclass) styleflags |= DNS_STYLEFLAG_NO_CLASS; - if (rrcomments) + /* Turn on rrcomments if explicitly enabled */ + if (rrcomments > 0) styleflags |= DNS_STYLEFLAG_RRCOMMENT; if (multiline) { styleflags |= DNS_STYLEFLAG_OMIT_OWNER; @@ -414,7 +419,9 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset, styleflags |= DNS_STYLEFLAG_TTL; styleflags |= DNS_STYLEFLAG_MULTILINE; styleflags |= DNS_STYLEFLAG_COMMENT; - styleflags |= DNS_STYLEFLAG_RRCOMMENT; + /* Turn on rrcomments if not explicitly disabled */ + if (rrcomments >= 0) + styleflags |= DNS_STYLEFLAG_RRCOMMENT; } if (multiline || (nottl && noclass)) @@ -455,7 +462,8 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) { styleflags |= DNS_STYLEFLAG_REL_OWNER; if (query->lookup->comments) styleflags |= DNS_STYLEFLAG_COMMENT; - if (rrcomments) + /* Turn on rrcomments if explicitly enabled */ + if (rrcomments > 0) styleflags |= DNS_STYLEFLAG_RRCOMMENT; if (nottl) styleflags |= DNS_STYLEFLAG_NO_TTL; @@ -468,7 +476,9 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) { styleflags |= DNS_STYLEFLAG_OMIT_TTL; styleflags |= DNS_STYLEFLAG_TTL; styleflags |= DNS_STYLEFLAG_MULTILINE; - styleflags |= DNS_STYLEFLAG_RRCOMMENT; + /* Turn on rrcomments unless explicitly disabled */ + if (rrcomments >= 0) + styleflags |= DNS_STYLEFLAG_RRCOMMENT; } if (multiline || (nottl && noclass)) result = dns_master_stylecreate2(&style, styleflags, @@ -720,7 +730,7 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) { */ static void -plus_option(char *option, isc_boolean_t is_batchfile, +plus_option(const char *option, isc_boolean_t is_batchfile, dig_lookup_t *lookup) { isc_result_t result; @@ -735,7 +745,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, strncpy(option_store, option, sizeof(option_store)); option_store[sizeof(option_store)-1]=0; ptr = option_store; - cmd = next_token(&ptr,"="); + cmd = next_token(&ptr, "="); if (cmd == NULL) { printf(";; Invalid option %s\n", option_store); return; @@ -789,7 +799,6 @@ plus_option(char *option, isc_boolean_t is_batchfile, lookup->section_answer = state; lookup->section_additional = state; lookup->comments = state; - rrcomments = state; lookup->stats = state; printcmd = state; break; @@ -955,13 +964,13 @@ plus_option(char *option, isc_boolean_t is_batchfile, lookup->identify = ISC_TRUE; lookup->stats = ISC_FALSE; lookup->comments = ISC_FALSE; - rrcomments = ISC_FALSE; lookup->section_additional = ISC_FALSE; lookup->section_authority = ISC_FALSE; lookup->section_question = ISC_FALSE; lookup->rdtype = dns_rdatatype_ns; lookup->rdtypeset = ISC_TRUE; short_form = ISC_TRUE; + rrcomments = 0; } break; default: @@ -1022,7 +1031,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, break; case 'r': /* rrcomments */ FULLCHECK("rrcomments"); - rrcomments = state; + rrcomments = state ? 1 : -1; break; default: goto invalid_option; @@ -1050,8 +1059,8 @@ plus_option(char *option, isc_boolean_t is_batchfile, lookup->section_authority = ISC_FALSE; lookup->section_question = ISC_FALSE; lookup->comments = ISC_FALSE; - rrcomments = ISC_FALSE; lookup->stats = ISC_FALSE; + rrcomments = -1; } break; case 'w': /* showsearch */ @@ -1149,7 +1158,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, lookup->recurse = ISC_FALSE; lookup->identify = ISC_TRUE; lookup->comments = ISC_FALSE; - rrcomments = ISC_FALSE; + rrcomments = 0; lookup->stats = ISC_FALSE; lookup->section_additional = ISC_FALSE; lookup->section_authority = ISC_TRUE; @@ -1207,7 +1216,7 @@ plus_option(char *option, isc_boolean_t is_batchfile, invalid_option: need_value: fprintf(stderr, "Invalid option: +%s\n", - option); + option); usage(); } return; @@ -1434,14 +1443,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup, value); return (value_from_next); case 'y': - ptr = next_token(&value,":"); /* hmac type or name */ + ptr = next_token(&value, ":"); /* hmac type or name */ if (ptr == NULL) { usage(); } ptr2 = next_token(&value, ":"); /* name or secret */ if (ptr2 == NULL) usage(); - ptr3 = next_token(&value,":"); /* secret or NULL */ + ptr3 = next_token(&value, ":"); /* secret or NULL */ if (ptr3 != NULL) { parse_hmac(ptr); ptr = ptr2; diff --git a/contrib/bind9/bin/dig/dig.docbook b/contrib/bind9/bin/dig/dig.docbook index 8a3022dfc..8b7e3829b 100644 --- a/contrib/bind9/bin/dig/dig.docbook +++ b/contrib/bind9/bin/dig/dig.docbook @@ -1,6 +1,3 @@ -]> - + + + + 2014-02-12 + - February 12, 2014 + ISC + Internet Systems Consortium, Inc. @@ -60,42 +62,42 @@ - + dig - @server - - - - - - - - - - - - - - name - type - class + @server + + + + + + + + + + + + + + name + type + class queryopt - + dig - + - + dig global-queryopt query - - DESCRIPTION + DESCRIPTION + dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and @@ -141,15 +143,15 @@ The IN and CH class names overlap with the IN and CH top level domain names. Either use the and - options to specify the type and class, + options to specify the type and class, use the the specify the domain name, or use "IN." and "CH." when looking up these top level domains. - + + + SIMPLE USAGE - - SIMPLE USAGE A typical invocation of dig looks like: @@ -198,7 +200,7 @@ type - indicates what type of query is required — + indicates what type of query is required — ANY, A, MX, SIG, etc. type can be any valid query type. If no @@ -212,10 +214,10 @@ - + + + OPTIONS - - OPTIONS @@ -415,10 +417,10 @@ - + + + QUERY OPTIONS - - QUERY OPTIONS dig provides a number of query options which affect @@ -1006,10 +1008,10 @@ - + + + MULTIPLE QUERIES - - MULTIPLE QUERIES The BIND 9 implementation of dig @@ -1055,10 +1057,10 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr isc.org. - + + + IDN SUPPORT - - IDN SUPPORT If dig has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -1067,21 +1069,21 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr reply from the server. If you'd like to turn off the IDN support for some reason, defines the IDN_DISABLE environment variable. - The IDN support is disabled if the variable is set when + The IDN support is disabled if the variable is set when dig runs. - + + + FILES - - FILES /etc/resolv.conf ${HOME}/.digrc - + + + SEE ALSO - - SEE ALSO host1 , @@ -1093,16 +1095,12 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr , RFC1035. - + + + BUGS - - BUGS There are probably too many query options. - - + + diff --git a/contrib/bind9/bin/dig/dig.html b/contrib/bind9/bin/dig/dig.html index 6cb32c118..6f92efcef 100644 --- a/contrib/bind9/bin/dig/dig.html +++ b/contrib/bind9/bin/dig/dig.html @@ -14,14 +14,13 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dig - + -
+

Name

@@ -33,41 +32,41 @@

dig [-h]

dig [global-queryopt...] [query...]

-
-

DESCRIPTION

-

dig +

+

DESCRIPTION

+

dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that - were queried. Most DNS administrators use dig to + were queried. Most DNS administrators use dig to troubleshoot DNS problems because of its flexibility, ease of use and clarity of output. Other lookup tools tend to have less functionality - than dig. + than dig.

- Although dig is normally used with + Although dig is normally used with command-line arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command-line arguments and options is printed when the -h option is given. Unlike earlier versions, the BIND 9 implementation of - dig allows multiple lookups to be issued + dig allows multiple lookups to be issued from the command line.

Unless it is told to query a specific name server, - dig will try each of the servers listed in + dig will try each of the servers listed in /etc/resolv.conf. If no usable server addresses - are found, dig will send the query to the local + are found, dig will send the query to the local host.

When no command line arguments or options are given, - dig will perform an NS query for "." (the root). + dig will perform an NS query for "." (the root).

- It is possible to set per-user defaults for dig via + It is possible to set per-user defaults for dig via ${HOME}/.digrc. This file is read and any options in it are applied before the command line arguments. @@ -75,22 +74,22 @@

The IN and CH class names overlap with the IN and CH top level domain names. Either use the -t and - -c options to specify the type and class, + -c options to specify the type and class, use the -q the specify the domain name, or use "IN." and "CH." when looking up these top level domains.

-
-

SIMPLE USAGE

+
+

SIMPLE USAGE

- A typical invocation of dig looks like: + A typical invocation of dig looks like: 

 dig @server name type

where:

-
+
server

@@ -98,19 +97,19 @@ can be an IPv4 address in dotted-decimal notation or an IPv6 address in colon-delimited notation. When the supplied server argument is a hostname, - dig resolves that name before querying + dig resolves that name before querying that name server.

If no server argument is - provided, dig consults + provided, dig consults /etc/resolv.conf; if an address is found there, it queries the name server at that address. If either of the -4 or -6 options are in use, then only addresses for the corresponding transport will be tried. If no usable addresses are found, - dig will send the query to the + dig will send the query to the local host. The reply from the name server that responds is displayed.

@@ -126,16 +125,16 @@ type can be any valid query type. If no type argument is supplied, - dig will perform a lookup for an + dig will perform a lookup for an A record.

-
-

OPTIONS

-
+
+

OPTIONS

+
-4

Use IPv4 only. @@ -159,12 +158,12 @@

-f file

- Batch mode: dig reads a list of lookup + Batch mode: dig reads a list of lookup requests to process from the given file. Each line in the file should be organized in the same way they would be presented as queries to - dig using the command-line interface. + dig using the command-line interface.

-i

@@ -177,11 +176,11 @@ Sign queries using TSIG using a key read from the given file. Key files can be generated using tsig-keygen(8). - When using TSIG authentication with dig, + When using TSIG authentication with dig, the name server that is queried needs to know the key and algorithm that is being used. In BIND, this is done by - providing appropriate key - and server statements in + providing appropriate key + and server statements in named.conf.

-m
@@ -228,7 +227,7 @@ need to provide the name, class and type - arguments. dig automatically performs a + arguments. dig automatically performs a lookup for a name like 94.2.0.192.in-addr.arpa and sets the query type and class to PTR and IN respectively. IPv6 @@ -261,9 +260,9 @@
-
-

QUERY OPTIONS

-

dig +

+

QUERY OPTIONS

+

dig provides a number of query options which affect the way in which lookups are made and the results displayed. Some of these set or reset flag bits in the query header, some determine which @@ -284,7 +283,7 @@ The query options are:

-
+
+[no]aaflag

A synonym for +[no]aaonly. @@ -353,7 +352,7 @@

+[no]cmd

Toggles the printing of the initial comment in the - output identifying the version of dig + output identifying the version of dig and the query options that have been applied. This comment is printed by default.

@@ -377,7 +376,7 @@

Set the search list to contain the single domain somename, as if specified in - a domain directive in + a domain directive in /etc/resolv.conf, and enable search list processing as if the +search option were given. @@ -421,7 +420,7 @@ Print records like the SOA records in a verbose multi-line format with human-readable comments. The default is to print each record on a single line, to - facilitate machine parsing of the dig + facilitate machine parsing of the dig output.

+ndots=D
@@ -445,7 +444,7 @@

+[no]nssearch

- When this option is set, dig + When this option is set, dig attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for @@ -476,7 +475,7 @@

Toggle the setting of the RD (recursion desired) bit in the query. This bit is set by default, which means - dig normally sends recursive + dig normally sends recursive queries. Recursion is automatically disabled when the +nssearch or +trace query options are used. @@ -573,7 +572,7 @@ Toggle tracing of the delegation path from the root name servers for the name being looked up. Tracing is disabled by default. When tracing is enabled, - dig makes iterative queries to + dig makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup. @@ -583,7 +582,7 @@ initial query for the root zone name servers.

- +dnssec is also set when +trace + +dnssec is also set when +trace is set to better emulate the default queries from a nameserver.

@@ -604,7 +603,7 @@ must be on its own line.

- If not specified, dig will look + If not specified, dig will look for /etc/trusted-key.key then trusted-key.key in the current directory. @@ -630,10 +629,10 @@

-
-

MULTIPLE QUERIES

+
+

MULTIPLE QUERIES

- The BIND 9 implementation of dig + The BIND 9 implementation of dig supports specifying multiple queries on the command line (in addition to supporting the -f batch file option). Each of those @@ -660,7 +659,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr

- shows how dig could be used from the + shows how dig could be used from the command line to make three lookups: an ANY query for www.isc.org, a reverse lookup of 127.0.0.1 and a query for the NS records of @@ -668,45 +667,45 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr A global query option of +qr is applied, so - that dig shows the initial query it made + that dig shows the initial query it made for each lookup. The final query has a local query option of - +noqr which means that dig + +noqr which means that dig will not print the initial query when it looks up the NS records for isc.org.

-
-

IDN SUPPORT

+
+

IDN SUPPORT

- If dig has been built with IDN (internationalized + If dig has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. - dig appropriately converts character encoding of + dig appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server. If you'd like to turn off the IDN support for some reason, defines the IDN_DISABLE environment variable. - The IDN support is disabled if the variable is set when - dig runs. + The IDN support is disabled if the variable is set when + dig runs.

-
-

FILES

+
+

FILES

/etc/resolv.conf

${HOME}/.digrc

-
-

SEE ALSO

+
+

SEE ALSO

host(1), named(8), dnssec-keygen(8), RFC1035.

-
-

BUGS

+
+

BUGS

There are probably too many query options.

diff --git a/contrib/bind9/bin/dig/dighost.c b/contrib/bind9/bin/dig/dighost.c index 45dac2f5a..36e7d4405 100644 --- a/contrib/bind9/bin/dig/dighost.c +++ b/contrib/bind9/bin/dig/dighost.c @@ -456,7 +456,7 @@ append(const char *text, int len, char **p, char *end) { static isc_result_t reverse_octets(const char *in, char **p, char *end) { - char *dot = strchr(in, '.'); + const char *dot = strchr(in, '.'); int len; if (dot != NULL) { isc_result_t result; @@ -3400,6 +3400,8 @@ recv_done(isc_task_t *task, isc_event_t *event) { n = requeue_lookup(l, ISC_TRUE); n->tcp_mode = ISC_TRUE; n->origin = query->lookup->origin; + if (l->trace && l->trace_root) + n->rdtype = l->qrdtype; dns_message_destroy(&msg); isc_event_free(&event); clear_query(query); diff --git a/contrib/bind9/bin/dig/host.1 b/contrib/bind9/bin/dig/host.1 index 4ff5a7cc6..f654d9776 100644 --- a/contrib/bind9/bin/dig/host.1 +++ b/contrib/bind9/bin/dig/host.1 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007-2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007-2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2002 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,43 +13,58 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: host .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: January 20, 2009 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2009-01-20 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "HOST" "1" "January 20, 2009" "BIND9" "BIND9" +.TH "HOST" "1" "2009\-01\-20" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" host \- DNS lookup utility .SH "SYNOPSIS" -.HP 5 +.HP \w'\fBhost\fR\ 'u \fBhost\fR [\fB\-aCdlnrsTwv\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-N\ \fR\fB\fIndots\fR\fR] [\fB\-R\ \fR\fB\fInumber\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-W\ \fR\fB\fIwait\fR\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [\fB\-v\fR] [\fB\-V\fR] {name} [server] .SH "DESCRIPTION" .PP \fBhost\fR -is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. When no arguments or options are given, +is a simple utility for performing DNS lookups\&. It is normally used to convert names to IP addresses and vice versa\&. When no arguments or options are given, \fBhost\fR -prints a short summary of its command line arguments and options. +prints a short summary of its command line arguments and options\&. .PP \fIname\fR -is the domain name that is to be looked up. It can also be a dotted\-decimal IPv4 address or a colon\-delimited IPv6 address, in which case +is the domain name that is to be looked up\&. It can also be a dotted\-decimal IPv4 address or a colon\-delimited IPv6 address, in which case \fBhost\fR -will by default perform a reverse lookup for that address. +will by default perform a reverse lookup for that address\&. \fIserver\fR is an optional argument which is either the name or IP address of the name server that \fBhost\fR should query instead of the server or servers listed in -\fI/etc/resolv.conf\fR. +/etc/resolv\&.conf\&. .PP The \fB\-a\fR @@ -57,7 +72,7 @@ The \fB\-v\fR option and asking \fBhost\fR -to make a query of type ANY. +to make a query of type ANY\&. .PP When the \fB\-C\fR @@ -65,12 +80,12 @@ option is used, \fBhost\fR will attempt to display the SOA records for zone \fIname\fR -from all the listed authoritative name servers for that zone. The list of name servers is defined by the NS records that are found for the zone. +from all the listed authoritative name servers for that zone\&. The list of name servers is defined by the NS records that are found for the zone\&. .PP The \fB\-c\fR option instructs to make a DNS query of class -\fIclass\fR. This can be used to lookup Hesiod or Chaosnet class resource records. The default class is IN (Internet). +\fIclass\fR\&. This can be used to lookup Hesiod or Chaosnet class resource records\&. The default class is IN (Internet)\&. .PP Verbose output is generated by \fBhost\fR @@ -78,114 +93,113 @@ when the \fB\-d\fR or \fB\-v\fR -option is used. The two options are equivalent. They have been provided for backwards compatibility. In previous versions, the +option is used\&. The two options are equivalent\&. They have been provided for backwards compatibility\&. In previous versions, the \fB\-d\fR option switched on debugging traces and \fB\-v\fR -enabled verbose output. +enabled verbose output\&. .PP List mode is selected by the \fB\-l\fR -option. This makes +option\&. This makes \fBhost\fR perform a zone transfer for zone -\fIname\fR. Transfer the zone printing out the NS, PTR and address records (A/AAAA). If combined with +\fIname\fR\&. Transfer the zone printing out the NS, PTR and address records (A/AAAA)\&. If combined with \fB\-a\fR -all records will be printed. +all records will be printed\&. .PP The \fB\-i\fR -option specifies that reverse lookups of IPv6 addresses should use the IP6.INT domain as defined in RFC1886. The default is to use IP6.ARPA. +option specifies that reverse lookups of IPv6 addresses should use the IP6\&.INT domain as defined in RFC1886\&. The default is to use IP6\&.ARPA\&. .PP The \fB\-N\fR option sets the number of dots that have to be in \fIname\fR -for it to be considered absolute. The default value is that defined using the ndots statement in -\fI/etc/resolv.conf\fR, or 1 if no ndots statement is present. Names with fewer dots are interpreted as relative names and will be searched for in the domains listed in the +for it to be considered absolute\&. The default value is that defined using the ndots statement in +/etc/resolv\&.conf, or 1 if no ndots statement is present\&. Names with fewer dots are interpreted as relative names and will be searched for in the domains listed in the \fBsearch\fR or \fBdomain\fR directive in -\fI/etc/resolv.conf\fR. +/etc/resolv\&.conf\&. .PP The number of UDP retries for a lookup can be changed with the \fB\-R\fR -option. +option\&. \fInumber\fR indicates how many times \fBhost\fR -will repeat a query that does not get answered. The default number of retries is 1. If +will repeat a query that does not get answered\&. The default number of retries is 1\&. If \fInumber\fR -is negative or zero, the number of retries will default to 1. +is negative or zero, the number of retries will default to 1\&. .PP Non\-recursive queries can be made via the \fB\-r\fR -option. Setting this option clears the +option\&. Setting this option clears the \fBRD\fR \(em recursion desired \(em bit in the query which \fBhost\fR -makes. This should mean that the name server receiving the query will not attempt to resolve -\fIname\fR. The +makes\&. This should mean that the name server receiving the query will not attempt to resolve +\fIname\fR\&. The \fB\-r\fR option enables \fBhost\fR -to mimic the behavior of a name server by making non\-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers. +to mimic the behavior of a name server by making non\-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers\&. .PP By default, \fBhost\fR -uses UDP when making queries. The +uses UDP when making queries\&. The \fB\-T\fR -option makes it use a TCP connection when querying the name server. TCP will be automatically selected for queries that require it, such as zone transfer (AXFR) requests. +option makes it use a TCP connection when querying the name server\&. TCP will be automatically selected for queries that require it, such as zone transfer (AXFR) requests\&. .PP The \fB\-4\fR option forces \fBhost\fR -to only use IPv4 query transport. The +to only use IPv4 query transport\&. The \fB\-6\fR option forces \fBhost\fR -to only use IPv6 query transport. +to only use IPv6 query transport\&. .PP The \fB\-t\fR -option is used to select the query type. +option is used to select the query type\&. \fItype\fR -can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, +can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc\&. When no query type is specified, \fBhost\fR -automatically selects an appropriate query type. By default, it looks for A, AAAA, and MX records, but if the +automatically selects an appropriate query type\&. By default, it looks for A, AAAA, and MX records, but if the \fB\-C\fR option was given, queries will be made for SOA records, and if \fIname\fR is a dotted\-decimal IPv4 address or colon\-delimited IPv6 address, \fBhost\fR -will query for PTR records. If a query type of IXFR is chosen the starting serial number can be specified by appending an equal followed by the starting serial number (e.g. \-t IXFR=12345678). +will query for PTR records\&. If a query type of IXFR is chosen the starting serial number can be specified by appending an equal followed by the starting serial number (e\&.g\&. \-t IXFR=12345678)\&. .PP The time to wait for a reply can be controlled through the \fB\-W\fR and \fB\-w\fR -options. The +options\&. The \fB\-W\fR option makes \fBhost\fR wait for \fIwait\fR -seconds. If +seconds\&. If \fIwait\fR -is less than one, the wait interval is set to one second. When the +is less than one, the wait interval is set to one second\&. When the \fB\-w\fR option is used, \fBhost\fR -will effectively wait forever for a reply. The time to wait for a response will be set to the number of seconds given by the hardware's maximum value for an integer quantity. +will effectively wait forever for a reply\&. The time to wait for a response will be set to the number of seconds given by the hardware\*(Aqs maximum value for an integer quantity\&. .PP The \fB\-s\fR option tells -\fBhost\fR -\fInot\fR -to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behavior. +\fBhost\fR\fInot\fR +to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behavior\&. .PP The \fB\-m\fR @@ -193,33 +207,37 @@ can be used to set the memory usage debugging flags \fIrecord\fR, \fIusage\fR and -\fItrace\fR. +\fItrace\fR\&. .PP The \fB\-V\fR option causes \fBhost\fR -to print the version number and exit. +to print the version number and exit\&. .SH "IDN SUPPORT" .PP If \fBhost\fR -has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names. +has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&. \fBhost\fR -appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server. If you'd like to turn off the IDN support for some reason, defines the +appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, defines the \fBIDN_DISABLE\fR -environment variable. The IDN support is disabled if the variable is set when +environment variable\&. The IDN support is disabled if the variable is set when \fBhost\fR -runs. +runs\&. .SH "FILES" .PP -\fI/etc/resolv.conf\fR +/etc/resolv\&.conf .SH "SEE ALSO" .PP \fBdig\fR(1), -\fBnamed\fR(8). +\fBnamed\fR(8)\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007\-2009, 2014 Internet Systems Consortium, Inc. ("ISC") .br -Copyright \(co 2000\-2002 Internet Software Consortium. +Copyright \(co 2004, 2005, 2007-2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2000-2002 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/dig/host.docbook b/contrib/bind9/bin/dig/host.docbook index 30fc44104..b004fb10a 100644 --- a/contrib/bind9/bin/dig/host.docbook +++ b/contrib/bind9/bin/dig/host.docbook @@ -1,8 +1,7 @@ -]> +]> - - + + + + 2009-01-20 + - January 20, 2009 + ISC + Internet Systems Consortium, Inc. @@ -43,6 +46,7 @@ 2008 2009 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -54,26 +58,26 @@ - + host - - - - - - - - - - - - name - server + + + + + + + + + + + + name + server - - DESCRIPTION + DESCRIPTION + host is a simple utility for performing DNS lookups. @@ -228,7 +232,7 @@ - The option tells host + The option tells host not to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behavior. @@ -245,13 +249,13 @@ The option causes host to print the version number and exit. - + + + IDN SUPPORT - - IDN SUPPORT If host has been built with IDN (internationalized - domain name) support, it can accept and display non-ASCII domain names. + domain name) support, it can accept and display non-ASCII domain names. host appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server. @@ -260,16 +264,16 @@ The IDN support is disabled if the variable is set when host runs. - + + + FILES - - FILES /etc/resolv.conf - + + + SEE ALSO - - SEE ALSO dig1 , @@ -277,10 +281,6 @@ named8 . + - - + diff --git a/contrib/bind9/bin/dig/host.html b/contrib/bind9/bin/dig/host.html index a04536afe..fb8c08f67 100644 --- a/contrib/bind9/bin/dig/host.html +++ b/contrib/bind9/bin/dig/host.html @@ -1,5 +1,5 @@ - host - + -
+

Name

@@ -31,34 +30,34 @@

Synopsis

host [-aCdlnrsTwv] [-c class] [-N ndots] [-R number] [-t type] [-W wait] [-m flag] [-4] [-6] [-v] [-V] {name} [server]

-
-

DESCRIPTION

-

host +

+

DESCRIPTION

+

host is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. When no arguments or options are given, - host + host prints a short summary of its command line arguments and options.

name is the domain name that is to be looked up. It can also be a dotted-decimal IPv4 address or a colon-delimited - IPv6 address, in which case host will by + IPv6 address, in which case host will by default perform a reverse lookup for that address. server is an optional argument which is either - the name or IP address of the name server that host + the name or IP address of the name server that host should query instead of the server or servers listed in /etc/resolv.conf.

The -a (all) option is equivalent to setting the - -v option and asking host to make + -v option and asking host to make a query of type ANY.

- When the -C option is used, host + When the -C option is used, host will attempt to display the SOA records for zone name from all the listed authoritative name @@ -72,7 +71,7 @@ Chaosnet class resource records. The default class is IN (Internet).

- Verbose output is generated by host when + Verbose output is generated by host when the -d or -v option is used. The two options are equivalent. They have been provided for backwards @@ -82,7 +81,7 @@

List mode is selected by the -l option. This makes - host perform a zone transfer for zone + host perform a zone transfer for zone name. Transfer the zone printing out the NS, PTR and address records (A/AAAA). If combined with -a @@ -110,7 +109,7 @@ The number of UDP retries for a lookup can be changed with the -R option. number indicates - how many times host will repeat a query + how many times host will repeat a query that does not get answered. The default number of retries is 1. If number is negative or zero, the @@ -120,39 +119,39 @@

Non-recursive queries can be made via the -r option. Setting this option clears the RD — recursion - desired — bit in the query which host makes. + desired — bit in the query which host makes. This should mean that the name server receiving the query will not attempt to resolve name. The - -r option enables host + -r option enables host to mimic the behavior of a name server by making non-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers.

- By default, host uses UDP when making + By default, host uses UDP when making queries. The -T option makes it use a TCP connection when querying the name server. TCP will be automatically selected for queries that require it, such as zone transfer (AXFR) requests.

- The -4 option forces host to only + The -4 option forces host to only use IPv4 query transport. The -6 option forces - host to only use IPv6 query transport. + host to only use IPv6 query transport.

The -t option is used to select the query type. type can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, - host automatically selects an appropriate + host automatically selects an appropriate query type. By default, it looks for A, AAAA, and MX records, but if the -C option was given, queries will be made for SOA records, and if name is a dotted-decimal IPv4 - address or colon-delimited IPv6 address, host will + address or colon-delimited IPv6 address, host will query for PTR records. If a query type of IXFR is chosen the starting serial number can be specified by appending an equal followed by the starting serial number (e.g. -t IXFR=12345678). @@ -160,18 +159,18 @@

The time to wait for a reply can be controlled through the -W and -w options. The - -W option makes host + -W option makes host wait for wait seconds. If wait is less than one, the wait interval is set to one second. When the - -w option is used, host + -w option is used, host will effectively wait forever for a reply. The time to wait for a response will be set to the number of seconds given by the hardware's maximum value for an integer quantity.

- The -s option tells host + The -s option tells host not to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behavior. @@ -183,31 +182,31 @@ trace.

- The -V option causes host + The -V option causes host to print the version number and exit.

-
-

IDN SUPPORT

+
+

IDN SUPPORT

- If host has been built with IDN (internationalized - domain name) support, it can accept and display non-ASCII domain names. - host appropriately converts character encoding of + If host has been built with IDN (internationalized + domain name) support, it can accept and display non-ASCII domain names. + host appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server. If you'd like to turn off the IDN support for some reason, defines the IDN_DISABLE environment variable. The IDN support is disabled if the variable is set when - host runs. + host runs.

-
-

FILES

+
+

FILES

/etc/resolv.conf

-
-

SEE ALSO

+
+

SEE ALSO

dig(1), named(8).

diff --git a/contrib/bind9/bin/dig/nslookup.1 b/contrib/bind9/bin/dig/nslookup.1 index e5ea2396a..c9c4c2f1b 100644 --- a/contrib/bind9/bin/dig/nslookup.1 +++ b/contrib/bind9/bin/dig/nslookup.1 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2007, 2010, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2007, 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,68 +12,100 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: nslookup .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: January 24, 2014 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2014-01-24 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "NSLOOKUP" "1" "January 24, 2014" "BIND9" "BIND9" +.TH "NSLOOKUP" "1" "2014\-01\-24" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" nslookup \- query Internet name servers interactively .SH "SYNOPSIS" -.HP 9 +.HP \w'\fBnslookup\fR\ 'u \fBnslookup\fR [\fB\-option\fR] [name\ |\ \-] [server] .SH "DESCRIPTION" .PP \fBNslookup\fR -is a program to query Internet domain name servers. +is a program to query Internet domain name servers\&. \fBNslookup\fR -has two modes: interactive and non\-interactive. Interactive mode allows the user to query name servers for information about various hosts and domains or to print a list of hosts in a domain. Non\-interactive mode is used to print just the name and requested information for a host or domain. +has two modes: interactive and non\-interactive\&. Interactive mode allows the user to query name servers for information about various hosts and domains or to print a list of hosts in a domain\&. Non\-interactive mode is used to print just the name and requested information for a host or domain\&. .SH "ARGUMENTS" .PP Interactive mode is entered in the following cases: -.TP 4 -1. +.sp +.RS 4 +.ie n \{\ +\h'-04' 1.\h'+01'\c +.\} +.el \{\ +.sp -1 +.IP " 1." 4.2 +.\} when no arguments are given (the default name server will be used) -.TP 4 -2. -when the first argument is a hyphen (\-) and the second argument is the host name or Internet address of a name server. +.RE .sp +.RS 4 +.ie n \{\ +\h'-04' 2.\h'+01'\c +.\} +.el \{\ +.sp -1 +.IP " 2." 4.2 +.\} +when the first argument is a hyphen (\-) and the second argument is the host name or Internet address of a name server\&. .RE .PP -Non\-interactive mode is used when the name or Internet address of the host to be looked up is given as the first argument. The optional second argument specifies the host name or address of a name server. +Non\-interactive mode is used when the name or Internet address of the host to be looked up is given as the first argument\&. The optional second argument specifies the host name or address of a name server\&. .PP -Options can also be specified on the command line if they precede the arguments and are prefixed with a hyphen. For example, to change the default query type to host information, and the initial timeout to 10 seconds, type: +Options can also be specified on the command line if they precede the arguments and are prefixed with a hyphen\&. For example, to change the default query type to host information, and the initial timeout to 10 seconds, type: .sp +.if n \{\ .RS 4 +.\} .nf nslookup \-query=hinfo \-timeout=10 .fi +.if n \{\ .RE -.sp +.\} .PP The \fB\-version\fR option causes \fBnslookup\fR -to print the version number and immediately exits. +to print the version number and immediately exits\&. .SH "INTERACTIVE COMMANDS" .PP \fBhost\fR [server] .RS 4 -Look up information for host using the current default server or using server, if specified. If host is an Internet address and the query type is A or PTR, the name of the host is returned. If host is a name and does not have a trailing period, the search list is used to qualify the name. +Look up information for host using the current default server or using server, if specified\&. If host is an Internet address and the query type is A or PTR, the name of the host is returned\&. If host is a name and does not have a trailing period, the search list is used to qualify the name\&. .sp -To look up a host not in the current domain, append a period to the name. +To look up a host not in the current domain, append a period to the name\&. .RE .PP \fBserver\fR \fIdomain\fR @@ -88,7 +120,7 @@ Change the default server to uses the initial server to look up information about \fIdomain\fR, while \fBserver\fR -uses the current default server. If an authoritative answer can't be found, the names of servers that might have the answer are returned. +uses the current default server\&. If an authoritative answer can\*(Aqt be found, the names of servers that might have the answer are returned\&. .RE .PP \fBroot\fR @@ -123,24 +155,22 @@ not implemented .PP \fBexit\fR .RS 4 -Exits the program. +Exits the program\&. .RE .PP \fBset\fR \fIkeyword\fR\fI[=value]\fR .RS 4 -This command is used to change state information that affects the lookups. Valid keywords are: -.RS 4 +This command is used to change state information that affects the lookups\&. Valid keywords are: .PP \fBall\fR .RS 4 Prints the current values of the frequently used options to -\fBset\fR. Information about the current default server and host is also printed. +\fBset\fR\&. Information about the current default server and host is also printed\&. .RE .PP \fBclass=\fR\fIvalue\fR .RS 4 Change the query class to one of: -.RS 4 .PP \fBIN\fR .RS 4 @@ -161,16 +191,15 @@ the Hesiod class .RS 4 wildcard .RE -.RE -.IP "" 4 -The class specifies the protocol group of the information. +.sp +The class specifies the protocol group of the information\&. .sp (Default = IN; abbreviation = cl) .RE .PP \fB \fR\fB\fI[no]\fR\fR\fBdebug\fR .RS 4 -Turn on or off the display of the full response packet and any intermediate response packets when searching. +Turn on or off the display of the full response packet and any intermediate response packets when searching\&. .sp (Default = nodebug; abbreviation = [no]deb) @@ -178,7 +207,7 @@ Turn on or off the display of the full response packet and any intermediate resp .PP \fB \fR\fB\fI[no]\fR\fR\fBd2\fR .RS 4 -Turn debugging mode on or off. This displays more about what nslookup is doing. +Turn debugging mode on or off\&. This displays more about what nslookup is doing\&. .sp (Default = nod2) .RE @@ -186,12 +215,12 @@ Turn debugging mode on or off. This displays more about what nslookup is doing. \fBdomain=\fR\fIname\fR .RS 4 Sets the search list to -\fIname\fR. +\fIname\fR\&. .RE .PP \fB \fR\fB\fI[no]\fR\fR\fBsearch\fR .RS 4 -If the lookup request contains at least one period but doesn't end with a trailing period, append the domain names in the domain search list to the request until an answer is received. +If the lookup request contains at least one period but doesn\*(Aqt end with a trailing period, append the domain names in the domain search list to the request until an answer is received\&. .sp (Default = search) .RE @@ -199,7 +228,7 @@ If the lookup request contains at least one period but doesn't end with a traili \fBport=\fR\fIvalue\fR .RS 4 Change the default TCP/UDP name server port to -\fIvalue\fR. +\fIvalue\fR\&. .sp (Default = 53; abbreviation = po) .RE @@ -210,60 +239,64 @@ Change the default TCP/UDP name server port to .PP \fBtype=\fR\fIvalue\fR .RS 4 -Change the type of the information query. +Change the type of the information query\&. .sp (Default = A; abbreviations = q, ty) .RE .PP \fB \fR\fB\fI[no]\fR\fR\fBrecurse\fR .RS 4 -Tell the name server to query other servers if it does not have the information. +Tell the name server to query other servers if it does not have the information\&. .sp (Default = recurse; abbreviation = [no]rec) .RE .PP \fBndots=\fR\fInumber\fR .RS 4 -Set the number of dots (label separators) in a domain that will disable searching. Absolute names always stop searching. +Set the number of dots (label separators) in a domain that will disable searching\&. Absolute names always stop searching\&. .RE .PP \fBretry=\fR\fInumber\fR .RS 4 -Set the number of retries to number. +Set the number of retries to number\&. .RE .PP \fBtimeout=\fR\fInumber\fR .RS 4 -Change the initial timeout interval for waiting for a reply to number seconds. +Change the initial timeout interval for waiting for a reply to number seconds\&. .RE .PP \fB \fR\fB\fI[no]\fR\fR\fBvc\fR .RS 4 -Always use a virtual circuit when sending requests to the server. +Always use a virtual circuit when sending requests to the server\&. .sp (Default = novc) .RE .PP \fB \fR\fB\fI[no]\fR\fR\fBfail\fR .RS 4 -Try the next nameserver if a nameserver responds with SERVFAIL or a referral (nofail) or terminate query (fail) on such a response. +Try the next nameserver if a nameserver responds with SERVFAIL or a referral (nofail) or terminate query (fail) on such a response\&. .sp (Default = nofail) .RE +.sp .RE -.IP "" 4 -.RE +.SH "RETURN VALUES" +.PP +\fBnslookup\fR +returns with an exit status of 1 if any query failed, and 0 otherwise\&. .SH "FILES" .PP -\fI/etc/resolv.conf\fR +/etc/resolv\&.conf .SH "SEE ALSO" .PP \fBdig\fR(1), \fBhost\fR(1), -\fBnamed\fR(8). +\fBnamed\fR(8)\&. .SH "AUTHOR" .PP -Andrew Cherenson +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004\-2007, 2010, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004-2007, 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/dig/nslookup.docbook b/contrib/bind9/bin/dig/nslookup.docbook index 022de672b..bd6d7b1fe 100644 --- a/contrib/bind9/bin/dig/nslookup.docbook +++ b/contrib/bind9/bin/dig/nslookup.docbook @@ -1,8 +1,5 @@ -]> - - + + + + 2014-01-24 + - January 24, 2014 + ISC + Internet Systems Consortium, Inc. @@ -71,21 +72,23 @@ 2010 2013 2014 + 2015 + 2016 Internet Systems Consortium, Inc. ("ISC") - + nslookup - - name | - - server + + name | - + server - - DESCRIPTION + DESCRIPTION + Nslookup is a program to query Internet domain name servers. Nslookup has two modes: interactive and non-interactive. Interactive mode allows @@ -95,13 +98,13 @@ used to print just the name and requested information for a host or domain. - + + + ARGUMENTS - - ARGUMENTS Interactive mode is entered in the following cases: - + when no arguments are given (the default name server will be used) @@ -139,10 +142,10 @@ nslookup -query=hinfo -timeout=10 number and immediately exits. - + + + INTERACTIVE COMMANDS - - INTERACTIVE COMMANDS host server @@ -475,16 +478,23 @@ nslookup -query=hinfo -timeout=10 - + + + RETURN VALUES + + nslookup returns with an exit status of 1 + if any query failed, and 0 otherwise. + + + + FILES - - FILES /etc/resolv.conf - + + + SEE ALSO - - SEE ALSO dig1 , @@ -495,16 +505,5 @@ nslookup -query=hinfo -timeout=10 named8 . - - - - Author - - Andrew Cherenson - - - + + diff --git a/contrib/bind9/bin/dig/nslookup.html b/contrib/bind9/bin/dig/nslookup.html index 96777b310..439ae2631 100644 --- a/contrib/bind9/bin/dig/nslookup.html +++ b/contrib/bind9/bin/dig/nslookup.html @@ -1,5 +1,5 @@ - nslookup - + -
-
+
+

Name

nslookup — query Internet name servers interactively

@@ -30,10 +29,10 @@

Synopsis

nslookup [-option] [name | -] [server]

-
-

DESCRIPTION

-

Nslookup - is a program to query Internet domain name servers. Nslookup +

+

DESCRIPTION

+

Nslookup + is a program to query Internet domain name servers. Nslookup has two modes: interactive and non-interactive. Interactive mode allows the user to query name servers for information about various hosts and domains or to print a list of hosts in a domain. Non-interactive mode @@ -42,16 +41,16 @@ domain.

-
-

ARGUMENTS

+
+

ARGUMENTS

Interactive mode is entered in the following cases:

-
    -

  1. +

      +

    1. when no arguments are given (the default name server will be used)

      2. -

    2. +

    3. when the first argument is a hyphen (-) and the second argument is the host name or Internet address of a name server.

      4. @@ -78,13 +77,13 @@ nslookup -query=hinfo -timeout=10

      The -version option causes - nslookup to print the version + nslookup to print the version number and immediately exits.

    -
    -

    INTERACTIVE COMMANDS

    -
    +
    +

    INTERACTIVE COMMANDS

    +
    host [server]

    @@ -144,11 +143,11 @@ nslookup -query=hinfo -timeout=10 This command is used to change state information that affects the lookups. Valid keywords are:

    -
    +
    all

    Prints the current values of the frequently used - options to set. + options to set. Information about the current default server and host is also printed.

    @@ -157,7 +156,7 @@ nslookup -query=hinfo -timeout=10

    Change the query class to one of:

    -
    +
    IN

    the Internet class @@ -298,23 +297,24 @@ nslookup -query=hinfo -timeout=10

    -
    -

    FILES

    +
    +

    RETURN VALUES

    +

    + nslookup returns with an exit status of 1 + if any query failed, and 0 otherwise. +

    +
    +
    +

    FILES

    /etc/resolv.conf

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    dig(1), host(1), named(8).

    -
    -

    Author

    -

    - Andrew Cherenson -

    -
    diff --git a/contrib/bind9/bin/dnssec/Makefile.in b/contrib/bind9/bin/dnssec/Makefile.in index 81f65938a..107bea907 100644 --- a/contrib/bind9/bin/dnssec/Makefile.in +++ b/contrib/bind9/bin/dnssec/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2005, 2007-2009, 2012-2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2005, 2007-2009, 2012-2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000-2002 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @BIND9_MAKE_INCLUDES@ @@ -51,7 +51,7 @@ OBJS = dnssectool.@O@ SRCS = dnssec-dsfromkey.c dnssec-keyfromlabel.c dnssec-keygen.c \ dnssec-revoke.c dnssec-settime.c dnssec-signzone.c \ - dnssec-verify.c dnssec-importkey.c dnssectool.c + dnssec-verify.c dnssec-importkey.c dnssectool.c MANPAGES = dnssec-dsfromkey.8 dnssec-keyfromlabel.8 dnssec-keygen.8 \ dnssec-revoke.8 dnssec-settime.8 dnssec-signzone.8 \ diff --git a/contrib/bind9/bin/dnssec/dnssec-dsfromkey.8 b/contrib/bind9/bin/dnssec/dnssec-dsfromkey.8 index 229433d5f..5f6312177 100644 --- a/contrib/bind9/bin/dnssec/dnssec-dsfromkey.8 +++ b/contrib/bind9/bin/dnssec/dnssec-dsfromkey.8 @@ -12,163 +12,179 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: dnssec\-dsfromkey +'\" t +.\" Title: dnssec-dsfromkey .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: May 17, 2012 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2012-05-17 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "DNSSEC\-DSFROMKEY" "8" "May 17, 2012" "BIND9" "BIND9" +.TH "DNSSEC\-DSFROMKEY" "8" "2012\-05\-17" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -dnssec\-dsfromkey \- DNSSEC DS RR generation tool +dnssec-dsfromkey \- DNSSEC DS RR generation tool .SH "SYNOPSIS" -.HP 17 +.HP \w'\fBdnssec\-dsfromkey\fR\ 'u \fBdnssec\-dsfromkey\fR [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] {keyfile} -.HP 17 +.HP \w'\fBdnssec\-dsfromkey\fR\ 'u \fBdnssec\-dsfromkey\fR {\-s} [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-A\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {dnsname} -.HP 17 +.HP \w'\fBdnssec\-dsfromkey\fR\ 'u \fBdnssec\-dsfromkey\fR [\fB\-h\fR] [\fB\-V\fR] .SH "DESCRIPTION" .PP \fBdnssec\-dsfromkey\fR -outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s). +outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s)\&. .SH "OPTIONS" .PP \-1 .RS 4 -Use SHA\-1 as the digest algorithm (the default is to use both SHA\-1 and SHA\-256). +Use SHA\-1 as the digest algorithm (the default is to use both SHA\-1 and SHA\-256)\&. .RE .PP \-2 .RS 4 -Use SHA\-256 as the digest algorithm. +Use SHA\-256 as the digest algorithm\&. .RE .PP \-a \fIalgorithm\fR .RS 4 -Select the digest algorithm. The value of +Select the digest algorithm\&. The value of \fBalgorithm\fR -must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST or SHA\-384 (SHA384). These values are case insensitive. +must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST or SHA\-384 (SHA384)\&. These values are case insensitive\&. .RE .PP \-C .RS 4 -Generate CDS records rather than DS records. This is mutually exclusive with generating lookaside records. +Generate CDS records rather than DS records\&. This is mutually exclusive with generating lookaside records\&. .RE .PP \-T \fITTL\fR .RS 4 -Specifies the TTL of the DS records. +Specifies the TTL of the DS records\&. .RE .PP \-K \fIdirectory\fR .RS 4 Look for key files (or, in keyset mode, -\fIkeyset\-\fR +keyset\- files) in -\fBdirectory\fR. +\fBdirectory\fR\&. .RE .PP \-f \fIfile\fR .RS 4 Zone file mode: in place of the keyfile name, the argument is the DNS domain name of a zone master file, which can be read from -\fBfile\fR. If the zone name is the same as -\fBfile\fR, then it may be omitted. +\fBfile\fR\&. If the zone name is the same as +\fBfile\fR, then it may be omitted\&. .sp If \fBfile\fR is set to -"\-", then the zone data is read from the standard input. This makes it possible to use the output of the +"\-", then the zone data is read from the standard input\&. This makes it possible to use the output of the \fBdig\fR command as input, as in: .sp -\fBdig dnskey example.com | dnssec\-dsfromkey \-f \- example.com\fR +\fBdig dnskey example\&.com | dnssec\-dsfromkey \-f \- example\&.com\fR .RE .PP \-A .RS 4 -Include ZSK's when generating DS records. Without this option, only keys which have the KSK flag set will be converted to DS records and printed. Useful only in zone file mode. +Include ZSK\*(Aqs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in zone file mode\&. .RE .PP \-l \fIdomain\fR .RS 4 -Generate a DLV set instead of a DS set. The specified +Generate a DLV set instead of a DS set\&. The specified \fBdomain\fR -is appended to the name for each record in the set. The DNSSEC Lookaside Validation (DLV) RR is described in RFC 4431. This is mutually exclusive with generating CDS records. +is appended to the name for each record in the set\&. The DNSSEC Lookaside Validation (DLV) RR is described in RFC 4431\&. This is mutually exclusive with generating CDS records\&. .RE .PP \-s .RS 4 -Keyset mode: in place of the keyfile name, the argument is the DNS domain name of a keyset file. +Keyset mode: in place of the keyfile name, the argument is the DNS domain name of a keyset file\&. .RE .PP \-c \fIclass\fR .RS 4 -Specifies the DNS class (default is IN). Useful only in keyset or zone file mode. +Specifies the DNS class (default is IN)\&. Useful only in keyset or zone file mode\&. .RE .PP \-v \fIlevel\fR .RS 4 -Sets the debugging level. +Sets the debugging level\&. .RE .PP \-h .RS 4 -Prints usage information. +Prints usage information\&. .RE .PP \-V .RS 4 -Prints version information. +Prints version information\&. .RE .SH "EXAMPLE" .PP To build the SHA\-256 DS RR from the -\fBKexample.com.+003+26160\fR +\fBKexample\&.com\&.+003+26160\fR keyfile name, the following command would be issued: .PP -\fBdnssec\-dsfromkey \-2 Kexample.com.+003+26160\fR +\fBdnssec\-dsfromkey \-2 Kexample\&.com\&.+003+26160\fR .PP The command would print something like: .PP -\fBexample.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94\fR +\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94\fR .SH "FILES" .PP The keyfile can be designed by the key identification -\fIKnnnn.+aaa+iiiii\fR +Knnnn\&.+aaa+iiiii or the full file name -\fIKnnnn.+aaa+iiiii.key\fR +Knnnn\&.+aaa+iiiii\&.key as generated by -dnssec\-keygen(8). +dnssec\-keygen(8)\&. .PP The keyset file name is built from the \fBdirectory\fR, the string -\fIkeyset\-\fR +keyset\- and the -\fBdnsname\fR. +\fBdnsname\fR\&. .SH "CAVEAT" .PP -A keyfile error can give a "file not found" even if the file exists. +A keyfile error can give a "file not found" even if the file exists\&. .SH "SEE ALSO" .PP -\fBdnssec\-keygen\fR(8), -\fBdnssec\-signzone\fR(8), +\fBdnssec-keygen\fR(8), +\fBdnssec-signzone\fR(8), BIND 9 Administrator Reference Manual, RFC 3658, -RFC 4431. -RFC 4509. +RFC 4431\&. +RFC 4509\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2008\-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/dnssec/dnssec-dsfromkey.docbook b/contrib/bind9/bin/dnssec/dnssec-dsfromkey.docbook index 1127fa04e..6cf7ac3ea 100644 --- a/contrib/bind9/bin/dnssec/dnssec-dsfromkey.docbook +++ b/contrib/bind9/bin/dnssec/dnssec-dsfromkey.docbook @@ -1,6 +1,3 @@ -]> - + + + + 2012-05-17 + - May 17, 2012 + ISC + Internet Systems Consortium, Inc. @@ -47,50 +49,50 @@ - + dnssec-dsfromkey - - - - - - - - keyfile + + + + + + + + keyfile - + dnssec-dsfromkey - -s - - - - - - - - - - - - dnsname + -s + + + + + + + + + + + + dnsname - + dnssec-dsfromkey - - + + - - DESCRIPTION + DESCRIPTION + dnssec-dsfromkey outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s). - + + + OPTIONS - - OPTIONS @@ -181,7 +183,7 @@ Include ZSK's when generating DS records. Without this option, only keys which have the KSK flag set will be converted to DS - records and printed. Useful only in zone file mode. + records and printed. Useful only in zone file mode. @@ -247,10 +249,10 @@ - + + + EXAMPLE - - EXAMPLE To build the SHA-256 DS RR from the Kexample.com.+003+26160 @@ -263,10 +265,10 @@ example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94 - + + + FILES - - FILES The keyfile can be designed by the key identification Knnnn.+aaa+iiiii or the full file name @@ -278,17 +280,17 @@ the string keyset- and the . - + + + CAVEAT - - CAVEAT A keyfile error can give a "file not found" even if the file exists. - + + + SEE ALSO - - SEE ALSO dnssec-keygen8 , @@ -300,16 +302,6 @@ RFC 4431. RFC 4509. - - - - AUTHOR - Internet Systems Consortium - - + - + diff --git a/contrib/bind9/bin/dnssec/dnssec-dsfromkey.html b/contrib/bind9/bin/dnssec/dnssec-dsfromkey.html index 13e9cc534..d470db327 100644 --- a/contrib/bind9/bin/dnssec/dnssec-dsfromkey.html +++ b/contrib/bind9/bin/dnssec/dnssec-dsfromkey.html @@ -13,14 +13,13 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dnssec-dsfromkey - + -
    +

    Name

    @@ -32,16 +31,16 @@

    dnssec-dsfromkey {-s} [-1] [-2] [-a alg] [-K directory] [-l domain] [-s] [-c class] [-T TTL] [-f file] [-A] [-v level] {dnsname}

    dnssec-dsfromkey [-h] [-V]

    -
    -

    DESCRIPTION

    -

    dnssec-dsfromkey +

    +

    DESCRIPTION

    +

    dnssec-dsfromkey outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s).

    -
    -

    OPTIONS

    -
    +
    +

    OPTIONS

    +
    -1

    Use SHA-1 as the digest algorithm (the default is to use @@ -84,7 +83,7 @@

    If file is set to "-", then the zone data is read from the standard input. This makes it - possible to use the output of the dig + possible to use the output of the dig command as input, as in:

    @@ -95,7 +94,7 @@

    Include ZSK's when generating DS records. Without this option, only keys which have the KSK flag set will be converted to DS - records and printed. Useful only in zone file mode. + records and printed. Useful only in zone file mode.

    -l domain

    @@ -130,8 +129,8 @@

    -
    -

    EXAMPLE

    +
    +

    EXAMPLE

    To build the SHA-256 DS RR from the Kexample.com.+003+26160 @@ -145,8 +144,8 @@

    example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94

    -
    -

    FILES

    +
    +

    FILES

    The keyfile can be designed by the key identification Knnnn.+aaa+iiiii or the full file name @@ -159,14 +158,14 @@ dnsname.

    -
    -

    CAVEAT

    +
    +

    CAVEAT

    A keyfile error can give a "file not found" even if the file exists.

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, @@ -175,10 +174,5 @@ RFC 4509.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/dnssec/dnssec-importkey.8 b/contrib/bind9/bin/dnssec/dnssec-importkey.8 index 225077da0..de57caa3d 100644 --- a/contrib/bind9/bin/dnssec/dnssec-importkey.8 +++ b/contrib/bind9/bin/dnssec/dnssec-importkey.8 @@ -1,120 +1,136 @@ -.\" Copyright (C) 2013, 2014 Internet Systems Consortium, Inc. ("ISC") -.\" +.\" Copyright (C) 2013-2015 Internet Systems Consortium, Inc. ("ISC") +.\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above .\" copyright notice and this permission notice appear in all copies. -.\" +.\" .\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH .\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, .\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM .\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: dnssec\-importkey +'\" t +.\" Title: dnssec-importkey .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: February 07, 2014 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2014-02-07 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "DNSSEC\-IMPORTKEY" "8" "February 07, 2014" "BIND9" "BIND9" +.TH "DNSSEC\-IMPORTKEY" "8" "2014\-02\-07" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -dnssec\-importkey \- Import DNSKEY records from external systems so they can be managed. +dnssec-importkey \- Import DNSKEY records from external systems so they can be managed\&. .SH "SYNOPSIS" -.HP 17 +.HP \w'\fBdnssec\-importkey\fR\ 'u \fBdnssec\-importkey\fR [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] {\fBkeyfile\fR} -.HP 17 +.HP \w'\fBdnssec\-importkey\fR\ 'u \fBdnssec\-importkey\fR {\fB\-f\ \fR\fB\fIfilename\fR\fR} [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fBdnsname\fR] .SH "DESCRIPTION" .PP \fBdnssec\-importkey\fR -reads a public DNSKEY record and generates a pair of .key/.private files. The DNSKEY record may be read from an existing .key file, in which case a corresponding .private file will be generated, or it may be read from any other file or from the standard input, in which case both .key and .private files will be generated. +reads a public DNSKEY record and generates a pair of \&.key/\&.private files\&. The DNSKEY record may be read from an existing \&.key file, in which case a corresponding \&.private file will be generated, or it may be read from any other file or from the standard input, in which case both \&.key and \&.private files will be generated\&. .PP -The newly\-created .private file does +The newly\-created \&.private file does \fInot\fR -contain private key data, and cannot be used for signing. However, having a .private file makes it possible to set publication (\fB\-P\fR) and deletion (\fB\-D\fR) times for the key, which means the public key can be added to and removed from the DNSKEY RRset on schedule even if the true private key is stored offline. +contain private key data, and cannot be used for signing\&. However, having a \&.private file makes it possible to set publication (\fB\-P\fR) and deletion (\fB\-D\fR) times for the key, which means the public key can be added to and removed from the DNSKEY RRset on schedule even if the true private key is stored offline\&. .SH "OPTIONS" .PP \-f \fIfilename\fR .RS 4 Zone file mode: instead of a public keyfile name, the argument is the DNS domain name of a zone master file, which can be read from -\fBfile\fR. If the domain name is the same as -\fBfile\fR, then it may be omitted. +\fBfile\fR\&. If the domain name is the same as +\fBfile\fR, then it may be omitted\&. .sp If \fBfile\fR is set to -"\-", then the zone data is read from the standard input. +"\-", then the zone data is read from the standard input\&. .RE .PP \-K \fIdirectory\fR .RS 4 -Sets the directory in which the key files are to reside. +Sets the directory in which the key files are to reside\&. .RE .PP \-L \fIttl\fR .RS 4 -Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. Setting the default TTL to +Sets the default TTL to use for this key when it is converted into a DNSKEY RR\&. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence\&. Setting the default TTL to 0 or none -removes it. +removes it\&. .RE .PP \-h .RS 4 -Emit usage message and exit. +Emit usage message and exit\&. .RE .PP \-v \fIlevel\fR .RS 4 -Sets the debugging level. +Sets the debugging level\&. .RE .PP \-V .RS 4 -Prints version information. +Prints version information\&. .RE .SH "TIMING OPTIONS" .PP -Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '\-', it is interpreted as an offset from the present time. For convenience, if such an offset is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds. To explicitly prevent a date from being set, use 'none' or 'never'. +Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argument begins with a \*(Aq+\*(Aq or \*(Aq\-\*(Aq, it is interpreted as an offset from the present time\&. For convenience, if such an offset is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively\&. Without a suffix, the offset is computed in seconds\&. To explicitly prevent a date from being set, use \*(Aqnone\*(Aq or \*(Aqnever\*(Aq\&. .PP \-P \fIdate/offset\fR .RS 4 -Sets the date on which a key is to be published to the zone. After that date, the key will be included in the zone but will not be used to sign it. +Sets the date on which a key is to be published to the zone\&. After that date, the key will be included in the zone but will not be used to sign it\&. .RE .PP \-D \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be deleted. After that date, the key will no longer be included in the zone. (It may remain in the key repository, however.) +Sets the date on which the key is to be deleted\&. After that date, the key will no longer be included in the zone\&. (It may remain in the key repository, however\&.) .RE .SH "FILES" .PP A keyfile can be designed by the key identification -\fIKnnnn.+aaa+iiiii\fR +Knnnn\&.+aaa+iiiii or the full file name -\fIKnnnn.+aaa+iiiii.key\fR +Knnnn\&.+aaa+iiiii\&.key as generated by -dnssec\-keygen(8). +dnssec\-keygen(8)\&. .SH "SEE ALSO" .PP -\fBdnssec\-keygen\fR(8), -\fBdnssec\-signzone\fR(8), +\fBdnssec-keygen\fR(8), +\fBdnssec-signzone\fR(8), BIND 9 Administrator Reference Manual, -RFC 5011. +RFC 5011\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2013, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2013-2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/dnssec/dnssec-importkey.docbook b/contrib/bind9/bin/dnssec/dnssec-importkey.docbook index 5893abd27..0fc469175 100644 --- a/contrib/bind9/bin/dnssec/dnssec-importkey.docbook +++ b/contrib/bind9/bin/dnssec/dnssec-importkey.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2014-02-07 + - February 07, 2014 + ISC + Internet Systems Consortium, Inc. @@ -37,38 +39,39 @@ 2013 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") - + dnssec-importkey - - - - - - - - + + + + + + + + - + dnssec-importkey - - - - - - - - - + + + + + + + + + - - DESCRIPTION + DESCRIPTION + dnssec-importkey reads a public DNSKEY record and generates a pair of .key/.private files. The DNSKEY record may be read from an @@ -86,10 +89,10 @@ public key can be added to and removed from the DNSKEY RRset on schedule even if the true private key is stored offline. - + + + OPTIONS - - OPTIONS @@ -107,7 +110,7 @@ - + -K directory @@ -139,7 +142,7 @@ - + -v level @@ -159,10 +162,10 @@ - + + + TIMING OPTIONS - - TIMING OPTIONS Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -199,20 +202,20 @@ - + + + FILES - - FILES A keyfile can be designed by the key identification Knnnn.+aaa+iiiii or the full file name Knnnn.+aaa+iiiii.key as generated by dnssec-keygen8. - + + + SEE ALSO - - SEE ALSO dnssec-keygen8 , @@ -222,16 +225,6 @@ BIND 9 Administrator Reference Manual, RFC 5011. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/dnssec/dnssec-importkey.html b/contrib/bind9/bin/dnssec/dnssec-importkey.html index 90f13f295..c0347d147 100644 --- a/contrib/bind9/bin/dnssec/dnssec-importkey.html +++ b/contrib/bind9/bin/dnssec/dnssec-importkey.html @@ -1,27 +1,25 @@ - - dnssec-importkey - + -
    +

    Name

    @@ -32,9 +30,9 @@

    dnssec-importkey [-K directory] [-L ttl] [-P date/offset] [-D date/offset] [-h] [-v level] [-V] {keyfile}

    dnssec-importkey {-f filename} [-K directory] [-L ttl] [-P date/offset] [-D date/offset] [-h] [-v level] [-V] [dnsname]

    -
    -

    DESCRIPTION

    -

    dnssec-importkey +

    +

    DESCRIPTION

    +

    dnssec-importkey reads a public DNSKEY record and generates a pair of .key/.private files. The DNSKEY record may be read from an existing .key file, in which case a corresponding .private file @@ -52,9 +50,9 @@ on schedule even if the true private key is stored offline.

    -
    -

    OPTIONS

    -
    +
    +

    OPTIONS

    +
    -f filename

    @@ -95,8 +93,8 @@

    -
    -

    TIMING OPTIONS

    +
    +

    TIMING OPTIONS

    Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -108,7 +106,7 @@ is computed in seconds. To explicitly prevent a date from being set, use 'none' or 'never'.

    -
    +
    -P date/offset

    Sets the date on which a key is to be published to the zone. @@ -123,8 +121,8 @@

    -
    -

    FILES

    +
    +

    FILES

    A keyfile can be designed by the key identification Knnnn.+aaa+iiiii or the full file name @@ -132,18 +130,13 @@ dnssec-keygen(8).

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 5011.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.8 b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.8 index 24da7c4d9..9e108fcfc 100644 --- a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.8 +++ b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2008-2012, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,237 +12,277 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: dnssec\-keyfromlabel +'\" t +.\" Title: dnssec-keyfromlabel .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: February 27, 2014 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2014-02-27 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "DNSSEC\-KEYFROMLABEL" "8" "February 27, 2014" "BIND9" "BIND9" +.TH "DNSSEC\-KEYFROMLABEL" "8" "2014\-02\-27" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -dnssec\-keyfromlabel \- DNSSEC key generation tool +dnssec-keyfromlabel \- DNSSEC key generation tool .SH "SYNOPSIS" -.HP 20 +.HP \w'\fBdnssec\-keyfromlabel\fR\ 'u \fBdnssec\-keyfromlabel\fR {\-l\ \fIlabel\fR} [\fB\-3\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-k\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-y\fR] {name} .SH "DESCRIPTION" .PP \fBdnssec\-keyfromlabel\fR -generates a key pair of files that referencing a key object stored in a cryptographic hardware service module (HSM). The private key file can be used for DNSSEC signing of zone data as if it were a conventional signing key created by -\fBdnssec\-keygen\fR, but the key material is stored within the HSM, and the actual signing takes place there. +generates a key pair of files that referencing a key object stored in a cryptographic hardware service module (HSM)\&. The private key file can be used for DNSSEC signing of zone data as if it were a conventional signing key created by +\fBdnssec\-keygen\fR, but the key material is stored within the HSM, and the actual signing takes place there\&. .PP The \fBname\fR -of the key is specified on the command line. This must match the name of the zone for which the key is being generated. +of the key is specified on the command line\&. This must match the name of the zone for which the key is being generated\&. .SH "OPTIONS" .PP \-a \fIalgorithm\fR .RS 4 -Selects the cryptographic algorithm. The value of +Selects the cryptographic algorithm\&. The value of \fBalgorithm\fR -must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256 or ECDSAP384SHA384. These values are case insensitive. +must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256 or ECDSAP384SHA384\&. These values are case insensitive\&. .sp If no algorithm is specified, then RSASHA1 will be used by default, unless the \fB\-3\fR -option is specified, in which case NSEC3RSASHA1 will be used instead. (If +option is specified, in which case NSEC3RSASHA1 will be used instead\&. (If \fB\-3\fR -is used and an algorithm is specified, that algorithm will be checked for compatibility with NSEC3.) +is used and an algorithm is specified, that algorithm will be checked for compatibility with NSEC3\&.) .sp -Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement algorithm, and DSA is recommended. +Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement algorithm, and DSA is recommended\&. .sp -Note 2: DH automatically sets the \-k flag. +Note 2: DH automatically sets the \-k flag\&. .RE .PP \-3 .RS 4 -Use an NSEC3\-capable algorithm to generate a DNSSEC key. If this option is used and no algorithm is explicitly set on the command line, NSEC3RSASHA1 will be used by default. +Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used and no algorithm is explicitly set on the command line, NSEC3RSASHA1 will be used by default\&. .RE .PP \-E \fIengine\fR .RS 4 -Specifies the name of the crypto hardware (OpenSSL engine). When compiled with PKCS#11 support it defaults to "pkcs11". +Specifies the name of the crypto hardware (OpenSSL engine)\&. When compiled with PKCS#11 support it defaults to "pkcs11"\&. .RE .PP \-l \fIlabel\fR .RS 4 -Specifies the label of the key pair in the crypto hardware. The label may be preceded by an optional OpenSSL engine name, separated by a colon, as in "pkcs11:keylabel". +Specifies the label of the key pair in the crypto hardware\&. The label may be preceded by an optional OpenSSL engine name, separated by a colon, as in "pkcs11:keylabel"\&. .RE .PP \-n \fInametype\fR .RS 4 -Specifies the owner type of the key. The value of +Specifies the owner type of the key\&. The value of \fBnametype\fR -must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY). These values are case insensitive. +must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY)\&. These values are case insensitive\&. .RE .PP \-C .RS 4 -Compatibility mode: generates an old\-style key, without any metadata. By default, +Compatibility mode: generates an old\-style key, without any metadata\&. By default, \fBdnssec\-keyfromlabel\fR -will include the key's creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc). Keys that include this data may be incompatible with older versions of BIND; the +will include the key\*(Aqs creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc)\&. Keys that include this data may be incompatible with older versions of BIND; the \fB\-C\fR -option suppresses them. +option suppresses them\&. .RE .PP \-c \fIclass\fR .RS 4 -Indicates that the DNS record containing the key should have the specified class. If not specified, class IN is used. +Indicates that the DNS record containing the key should have the specified class\&. If not specified, class IN is used\&. .RE .PP \-f \fIflag\fR .RS 4 -Set the specified flag in the flag field of the KEY/DNSKEY record. The only recognized flags are KSK (Key Signing Key) and REVOKE. +Set the specified flag in the flag field of the KEY/DNSKEY record\&. The only recognized flags are KSK (Key Signing Key) and REVOKE\&. .RE .PP \-G .RS 4 -Generate a key, but do not publish it or sign with it. This option is incompatible with \-P and \-A. +Generate a key, but do not publish it or sign with it\&. This option is incompatible with \-P and \-A\&. .RE .PP \-h .RS 4 Prints a short summary of the options and arguments to -\fBdnssec\-keyfromlabel\fR. +\fBdnssec\-keyfromlabel\fR\&. .RE .PP \-K \fIdirectory\fR .RS 4 -Sets the directory in which the key files are to be written. +Sets the directory in which the key files are to be written\&. .RE .PP \-k .RS 4 -Generate KEY records rather than DNSKEY records. +Generate KEY records rather than DNSKEY records\&. .RE .PP \-L \fIttl\fR .RS 4 -Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. Setting the default TTL to +Sets the default TTL to use for this key when it is converted into a DNSKEY RR\&. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence\&. Setting the default TTL to 0 or none -removes it. +removes it\&. .RE .PP \-p \fIprotocol\fR .RS 4 -Sets the protocol value for the key. The protocol is a number between 0 and 255. The default is 3 (DNSSEC). Other possible values for this argument are listed in RFC 2535 and its successors. +Sets the protocol value for the key\&. The protocol is a number between 0 and 255\&. The default is 3 (DNSSEC)\&. Other possible values for this argument are listed in RFC 2535 and its successors\&. .RE .PP \-S \fIkey\fR .RS 4 -Generate a key as an explicit successor to an existing key. The name, algorithm, size, and type of the key will be set to match the predecessor. The activation date of the new key will be set to the inactivation date of the existing one. The publication date will be set to the activation date minus the prepublication interval, which defaults to 30 days. +Generate a key as an explicit successor to an existing key\&. The name, algorithm, size, and type of the key will be set to match the predecessor\&. The activation date of the new key will be set to the inactivation date of the existing one\&. The publication date will be set to the activation date minus the prepublication interval, which defaults to 30 days\&. .RE .PP \-t \fItype\fR .RS 4 -Indicates the use of the key. +Indicates the use of the key\&. \fBtype\fR -must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data. +must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF\&. The default is AUTHCONF\&. AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data\&. .RE .PP \-v \fIlevel\fR .RS 4 -Sets the debugging level. +Sets the debugging level\&. .RE .PP \-V .RS 4 -Prints version information. +Prints version information\&. .RE .PP \-y .RS 4 -Allows DNSSEC key files to be generated even if the key ID would collide with that of an existing key, in the event of either key being revoked. (This is only safe to use if you are sure you won't be using RFC 5011 trust anchor maintenance with either of the keys involved.) +Allows DNSSEC key files to be generated even if the key ID would collide with that of an existing key, in the event of either key being revoked\&. (This is only safe to use if you are sure you won\*(Aqt be using RFC 5011 trust anchor maintenance with either of the keys involved\&.) .RE .SH "TIMING OPTIONS" .PP -Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '\-', it is interpreted as an offset from the present time. For convenience, if such an offset is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds. To explicitly prevent a date from being set, use 'none' or 'never'. +Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argument begins with a \*(Aq+\*(Aq or \*(Aq\-\*(Aq, it is interpreted as an offset from the present time\&. For convenience, if such an offset is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively\&. Without a suffix, the offset is computed in seconds\&. To explicitly prevent a date from being set, use \*(Aqnone\*(Aq or \*(Aqnever\*(Aq\&. .PP \-P \fIdate/offset\fR .RS 4 -Sets the date on which a key is to be published to the zone. After that date, the key will be included in the zone but will not be used to sign it. If not set, and if the \-G option has not been used, the default is "now". +Sets the date on which a key is to be published to the zone\&. After that date, the key will be included in the zone but will not be used to sign it\&. If not set, and if the \-G option has not been used, the default is "now"\&. .RE .PP \-A \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be activated. After that date, the key will be included in the zone and used to sign it. If not set, and if the \-G option has not been used, the default is "now". +Sets the date on which the key is to be activated\&. After that date, the key will be included in the zone and used to sign it\&. If not set, and if the \-G option has not been used, the default is "now"\&. .RE .PP \-R \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be revoked. After that date, the key will be flagged as revoked. It will be included in the zone and will be used to sign it. +Sets the date on which the key is to be revoked\&. After that date, the key will be flagged as revoked\&. It will be included in the zone and will be used to sign it\&. .RE .PP \-I \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be retired. After that date, the key will still be included in the zone, but it will not be used to sign it. +Sets the date on which the key is to be retired\&. After that date, the key will still be included in the zone, but it will not be used to sign it\&. .RE .PP \-D \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be deleted. After that date, the key will no longer be included in the zone. (It may remain in the key repository, however.) +Sets the date on which the key is to be deleted\&. After that date, the key will no longer be included in the zone\&. (It may remain in the key repository, however\&.) .RE .PP \-i \fIinterval\fR .RS 4 -Sets the prepublication interval for a key. If set, then the publication and activation dates must be separated by at least this much time. If the activation date is specified but the publication date isn't, then the publication date will default to this much time before the activation date; conversely, if the publication date is specified but activation date isn't, then activation will be set to this much time after publication. +Sets the prepublication interval for a key\&. If set, then the publication and activation dates must be separated by at least this much time\&. If the activation date is specified but the publication date isn\*(Aqt, then the publication date will default to this much time before the activation date; conversely, if the publication date is specified but activation date isn\*(Aqt, then activation will be set to this much time after publication\&. .sp -If the key is being created as an explicit successor to another key, then the default prepublication interval is 30 days; otherwise it is zero. +If the key is being created as an explicit successor to another key, then the default prepublication interval is 30 days; otherwise it is zero\&. .sp -As with date offsets, if the argument is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the interval is measured in years, months, weeks, days, hours, or minutes, respectively. Without a suffix, the interval is measured in seconds. +As with date offsets, if the argument is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the interval is measured in years, months, weeks, days, hours, or minutes, respectively\&. Without a suffix, the interval is measured in seconds\&. .RE .SH "GENERATED KEY FILES" .PP When \fBdnssec\-keyfromlabel\fR completes successfully, it prints a string of the form -\fIKnnnn.+aaa+iiiii\fR -to the standard output. This is an identification string for the key files it has generated. -.TP 4 -\(bu -\fInnnn\fR -is the key name. -.TP 4 -\(bu -\fIaaa\fR -is the numeric representation of the algorithm. -.TP 4 -\(bu -\fIiiiii\fR -is the key identifier (or footprint). +Knnnn\&.+aaa+iiiii +to the standard output\&. This is an identification string for the key files it has generated\&. +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +nnnn +is the key name\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +aaa +is the numeric representation of the algorithm\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +iiiii +is the key identifier (or footprint)\&. +.RE .PP \fBdnssec\-keyfromlabel\fR -creates two files, with names based on the printed string. -\fIKnnnn.+aaa+iiiii.key\fR +creates two files, with names based on the printed string\&. +Knnnn\&.+aaa+iiiii\&.key contains the public key, and -\fIKnnnn.+aaa+iiiii.private\fR -contains the private key. +Knnnn\&.+aaa+iiiii\&.private +contains the private key\&. .PP The -\fI.key\fR -file contains a DNS KEY record that can be inserted into a zone file (directly or with a $INCLUDE statement). +\&.key +file contains a DNS KEY record that can be inserted into a zone file (directly or with a $INCLUDE statement)\&. .PP The -\fI.private\fR -file contains algorithm\-specific fields. For obvious security reasons, this file does not have general read permission. +\&.private +file contains algorithm\-specific fields\&. For obvious security reasons, this file does not have general read permission\&. .SH "SEE ALSO" .PP -\fBdnssec\-keygen\fR(8), -\fBdnssec\-signzone\fR(8), +\fBdnssec-keygen\fR(8), +\fBdnssec-signzone\fR(8), BIND 9 Administrator Reference Manual, -RFC 4034. +RFC 4034\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2008\-2012, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.docbook b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.docbook index a47c95589..6ee9f952e 100644 --- a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.docbook +++ b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2014-02-27 + - February 27, 2014 + ISC + Internet Systems Consortium, Inc. @@ -41,42 +43,43 @@ 2011 2012 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") - + dnssec-keyfromlabel - -l label - - - - - - - - - - - - - - - - - - - - - - - name + -l label + + + + + + + + + + + + + + + + + + + + + + + name - - DESCRIPTION + DESCRIPTION + dnssec-keyfromlabel generates a key pair of files that referencing a key object stored in a cryptographic hardware service module (HSM). The private key @@ -90,10 +93,10 @@ line. This must match the name of the zone for which the key is being generated. - + + + OPTIONS - - OPTIONS @@ -328,10 +331,10 @@ - + + + TIMING OPTIONS - - TIMING OPTIONS Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. @@ -417,7 +420,7 @@ If the key is being created as an explicit successor to another - key, then the default prepublication interval is 30 days; + key, then the default prepublication interval is 30 days; otherwise it is zero. @@ -431,10 +434,10 @@ - + + + GENERATED KEY FILES - - GENERATED KEY FILES When dnssec-keyfromlabel completes successfully, @@ -458,7 +461,7 @@ - dnssec-keyfromlabel + dnssec-keyfromlabel creates two files, with names based on the printed string. Knnnn.+aaa+iiiii.key contains the public key, and @@ -477,10 +480,10 @@ fields. For obvious security reasons, this file does not have general read permission. - + + + SEE ALSO - - SEE ALSO dnssec-keygen8 , @@ -490,16 +493,6 @@ BIND 9 Administrator Reference Manual, RFC 4034. - - - - AUTHOR - Internet Systems Consortium - - + - + diff --git a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html index 36971c466..eeb534591 100644 --- a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html +++ b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html @@ -1,5 +1,5 @@ - dnssec-keyfromlabel - + -
    +

    Name

    @@ -30,13 +29,13 @@

    Synopsis

    dnssec-keyfromlabel {-l label} [-3] [-a algorithm] [-A date/offset] [-c class] [-D date/offset] [-E engine] [-f flag] [-G] [-I date/offset] [-i interval] [-k] [-K directory] [-L ttl] [-n nametype] [-P date/offset] [-p protocol] [-R date/offset] [-S key] [-t type] [-v level] [-V] [-y] {name}

    -
    -

    DESCRIPTION

    -

    dnssec-keyfromlabel +

    +

    DESCRIPTION

    +

    dnssec-keyfromlabel generates a key pair of files that referencing a key object stored in a cryptographic hardware service module (HSM). The private key file can be used for DNSSEC signing of zone data as if it were a - conventional signing key created by dnssec-keygen, + conventional signing key created by dnssec-keygen, but the key material is stored within the HSM, and the actual signing takes place there.

    @@ -46,9 +45,9 @@ being generated.

    -
    -

    OPTIONS

    -
    +
    +

    OPTIONS

    +
    -a algorithm

    @@ -103,7 +102,7 @@

    -C

    Compatibility mode: generates an old-style key, without - any metadata. By default, dnssec-keyfromlabel + any metadata. By default, dnssec-keyfromlabel will include the key's creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc). Keys that include @@ -128,7 +127,7 @@

    -h

    Prints a short summary of the options and arguments to - dnssec-keyfromlabel. + dnssec-keyfromlabel.

    -K directory

    @@ -189,8 +188,8 @@

    -
    -

    TIMING OPTIONS

    +
    +

    TIMING OPTIONS

    Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -202,7 +201,7 @@ is computed in seconds. To explicitly prevent a date from being set, use 'none' or 'never'.

    -
    +
    -P date/offset

    Sets the date on which a key is to be published to the zone. @@ -248,7 +247,7 @@

    If the key is being created as an explicit successor to another - key, then the default prepublication interval is 30 days; + key, then the default prepublication interval is 30 days; otherwise it is zero.

    @@ -261,26 +260,26 @@

    -
    -

    GENERATED KEY FILES

    +
    +

    GENERATED KEY FILES

    - When dnssec-keyfromlabel completes + When dnssec-keyfromlabel completes successfully, it prints a string of the form Knnnn.+aaa+iiiii to the standard output. This is an identification string for the key files it has generated.

    -
      -

    • nnnn is the key name. +

        +

      • nnnn is the key name.

        • -

      • aaa is the numeric representation +

      • aaa is the numeric representation of the algorithm.

        • -

      • iiiii is the key identifier (or +

      • iiiii is the key identifier (or footprint).

      -

      dnssec-keyfromlabel +

      dnssec-keyfromlabel creates two files, with names based on the printed string. Knnnn.+aaa+iiiii.key contains the public key, and @@ -300,18 +299,13 @@ general read permission.

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 4034.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/dnssec/dnssec-keygen.8 b/contrib/bind9/bin/dnssec/dnssec-keygen.8 index 2cd5d76ff..acbbbbd0e 100644 --- a/contrib/bind9/bin/dnssec/dnssec-keygen.8 +++ b/contrib/bind9/bin/dnssec/dnssec-keygen.8 @@ -13,301 +13,341 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: dnssec\-keygen +'\" t +.\" Title: dnssec-keygen .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: February 07, 2014 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2014-02-07 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "DNSSEC\-KEYGEN" "8" "February 07, 2014" "BIND9" "BIND9" +.TH "DNSSEC\-KEYGEN" "8" "2014\-02\-07" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -dnssec\-keygen \- DNSSEC key generation tool +dnssec-keygen \- DNSSEC key generation tool .SH "SYNOPSIS" -.HP 14 +.HP \w'\fBdnssec\-keygen\fR\ 'u \fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-k\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-z\fR] {name} .SH "DESCRIPTION" .PP \fBdnssec\-keygen\fR -generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY (Transaction Key) as defined in RFC 2930. +generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034\&. It can also generate keys for use with TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY (Transaction Key) as defined in RFC 2930\&. .PP The \fBname\fR -of the key is specified on the command line. For DNSSEC keys, this must match the name of the zone for which the key is being generated. +of the key is specified on the command line\&. For DNSSEC keys, this must match the name of the zone for which the key is being generated\&. .SH "OPTIONS" .PP \-a \fIalgorithm\fR .RS 4 -Selects the cryptographic algorithm. For DNSSEC keys, the value of +Selects the cryptographic algorithm\&. For DNSSEC keys, the value of \fBalgorithm\fR -must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256 or ECDSAP384SHA384. For TSIG/TKEY, the value must be DH (Diffie Hellman), HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512. These values are case insensitive. +must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256 or ECDSAP384SHA384\&. For TSIG/TKEY, the value must be DH (Diffie Hellman), HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. These values are case insensitive\&. .sp If no algorithm is specified, then RSASHA1 will be used by default, unless the \fB\-3\fR -option is specified, in which case NSEC3RSASHA1 will be used instead. (If +option is specified, in which case NSEC3RSASHA1 will be used instead\&. (If \fB\-3\fR -is used and an algorithm is specified, that algorithm will be checked for compatibility with NSEC3.) +is used and an algorithm is specified, that algorithm will be checked for compatibility with NSEC3\&.) .sp -Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement algorithm, and DSA is recommended. For TSIG, HMAC\-MD5 is mandatory. +Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement algorithm, and DSA is recommended\&. For TSIG, HMAC\-MD5 is mandatory\&. .sp -Note 2: DH, HMAC\-MD5, and HMAC\-SHA1 through HMAC\-SHA512 automatically set the \-T KEY option. +Note 2: DH, HMAC\-MD5, and HMAC\-SHA1 through HMAC\-SHA512 automatically set the \-T KEY option\&. .RE .PP \-b \fIkeysize\fR .RS 4 -Specifies the number of bits in the key. The choice of key size depends on the algorithm used. RSA keys must be between 512 and 2048 bits. Diffie Hellman keys must be between 128 and 4096 bits. DSA keys must be between 512 and 1024 bits and an exact multiple of 64. HMAC keys must be between 1 and 512 bits. Elliptic curve algorithms don't need this parameter. +Specifies the number of bits in the key\&. The choice of key size depends on the algorithm used\&. RSA keys must be between 512 and 2048 bits\&. Diffie Hellman keys must be between 128 and 4096 bits\&. DSA keys must be between 512 and 1024 bits and an exact multiple of 64\&. HMAC keys must be between 1 and 512 bits\&. Elliptic curve algorithms don\*(Aqt need this parameter\&. .sp -The key size does not need to be specified if using a default algorithm. The default key size is 1024 bits for zone signing keys (ZSK's) and 2048 bits for key signing keys (KSK's, generated with -\fB\-f KSK\fR). However, if an algorithm is explicitly specified with the +The key size does not need to be specified if using a default algorithm\&. The default key size is 1024 bits for zone signing keys (ZSK\*(Aqs) and 2048 bits for key signing keys (KSK\*(Aqs, generated with +\fB\-f KSK\fR)\&. However, if an algorithm is explicitly specified with the \fB\-a\fR, then there is no default key size, and the \fB\-b\fR -must be used. +must be used\&. .RE .PP \-n \fInametype\fR .RS 4 -Specifies the owner type of the key. The value of +Specifies the owner type of the key\&. The value of \fBnametype\fR -must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY). These values are case insensitive. Defaults to ZONE for DNSKEY generation. +must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY)\&. These values are case insensitive\&. Defaults to ZONE for DNSKEY generation\&. .RE .PP \-3 .RS 4 -Use an NSEC3\-capable algorithm to generate a DNSSEC key. If this option is used and no algorithm is explicitly set on the command line, NSEC3RSASHA1 will be used by default. Note that RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256 and ECDSAP384SHA384 algorithms are NSEC3\-capable. +Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used and no algorithm is explicitly set on the command line, NSEC3RSASHA1 will be used by default\&. Note that RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256 and ECDSAP384SHA384 algorithms are NSEC3\-capable\&. .RE .PP \-C .RS 4 -Compatibility mode: generates an old\-style key, without any metadata. By default, +Compatibility mode: generates an old\-style key, without any metadata\&. By default, \fBdnssec\-keygen\fR -will include the key's creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc). Keys that include this data may be incompatible with older versions of BIND; the +will include the key\*(Aqs creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc)\&. Keys that include this data may be incompatible with older versions of BIND; the \fB\-C\fR -option suppresses them. +option suppresses them\&. .RE .PP \-c \fIclass\fR .RS 4 -Indicates that the DNS record containing the key should have the specified class. If not specified, class IN is used. +Indicates that the DNS record containing the key should have the specified class\&. If not specified, class IN is used\&. .RE .PP \-E \fIengine\fR .RS 4 -Uses a crypto hardware (OpenSSL engine) for random number and, when supported, key generation. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine. +Uses a crypto hardware (OpenSSL engine) for random number and, when supported, key generation\&. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine\&. .RE .PP \-f \fIflag\fR .RS 4 -Set the specified flag in the flag field of the KEY/DNSKEY record. The only recognized flags are KSK (Key Signing Key) and REVOKE. +Set the specified flag in the flag field of the KEY/DNSKEY record\&. The only recognized flags are KSK (Key Signing Key) and REVOKE\&. .RE .PP \-G .RS 4 -Generate a key, but do not publish it or sign with it. This option is incompatible with \-P and \-A. +Generate a key, but do not publish it or sign with it\&. This option is incompatible with \-P and \-A\&. .RE .PP \-g \fIgenerator\fR .RS 4 -If generating a Diffie Hellman key, use this generator. Allowed values are 2 and 5. If no generator is specified, a known prime from RFC 2539 will be used if possible; otherwise the default is 2. +If generating a Diffie Hellman key, use this generator\&. Allowed values are 2 and 5\&. If no generator is specified, a known prime from RFC 2539 will be used if possible; otherwise the default is 2\&. .RE .PP \-h .RS 4 Prints a short summary of the options and arguments to -\fBdnssec\-keygen\fR. +\fBdnssec\-keygen\fR\&. .RE .PP \-K \fIdirectory\fR .RS 4 -Sets the directory in which the key files are to be written. +Sets the directory in which the key files are to be written\&. .RE .PP \-k .RS 4 -Deprecated in favor of \-T KEY. +Deprecated in favor of \-T KEY\&. .RE .PP \-L \fIttl\fR .RS 4 -Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL. Setting the default TTL to +Sets the default TTL to use for this key when it is converted into a DNSKEY RR\&. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence\&. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL\&. Setting the default TTL to 0 or none -is the same as leaving it unset. +is the same as leaving it unset\&. .RE .PP \-p \fIprotocol\fR .RS 4 -Sets the protocol value for the generated key. The protocol is a number between 0 and 255. The default is 3 (DNSSEC). Other possible values for this argument are listed in RFC 2535 and its successors. +Sets the protocol value for the generated key\&. The protocol is a number between 0 and 255\&. The default is 3 (DNSSEC)\&. Other possible values for this argument are listed in RFC 2535 and its successors\&. .RE .PP \-q .RS 4 -Quiet mode: Suppresses unnecessary output, including progress indication. Without this option, when +Quiet mode: Suppresses unnecessary output, including progress indication\&. Without this option, when \fBdnssec\-keygen\fR is run interactively to generate an RSA or DSA key pair, it will print a string of symbols to -\fIstderr\fR -indicating the progress of the key generation. A '.' indicates that a random number has been found which passed an initial sieve test; '+' means a number has passed a single round of the Miller\-Rabin primality test; a space means that the number has passed all the tests and is a satisfactory key. +stderr +indicating the progress of the key generation\&. A \*(Aq\&.\*(Aq indicates that a random number has been found which passed an initial sieve test; \*(Aq+\*(Aq means a number has passed a single round of the Miller\-Rabin primality test; a space means that the number has passed all the tests and is a satisfactory key\&. .RE .PP \-r \fIrandomdev\fR .RS 4 -Specifies the source of randomness. If the operating system does not provide a -\fI/dev/random\fR -or equivalent device, the default source of randomness is keyboard input. -\fIrandomdev\fR -specifies the name of a character device or file containing random data to be used instead of the default. The special value -\fIkeyboard\fR -indicates that keyboard input should be used. +Specifies the source of randomness\&. If the operating system does not provide a +/dev/random +or equivalent device, the default source of randomness is keyboard input\&. +randomdev +specifies the name of a character device or file containing random data to be used instead of the default\&. The special value +keyboard +indicates that keyboard input should be used\&. .RE .PP \-S \fIkey\fR .RS 4 -Create a new key which is an explicit successor to an existing key. The name, algorithm, size, and type of the key will be set to match the existing key. The activation date of the new key will be set to the inactivation date of the existing one. The publication date will be set to the activation date minus the prepublication interval, which defaults to 30 days. +Create a new key which is an explicit successor to an existing key\&. The name, algorithm, size, and type of the key will be set to match the existing key\&. The activation date of the new key will be set to the inactivation date of the existing one\&. The publication date will be set to the activation date minus the prepublication interval, which defaults to 30 days\&. .RE .PP \-s \fIstrength\fR .RS 4 -Specifies the strength value of the key. The strength is a number between 0 and 15, and currently has no defined purpose in DNSSEC. +Specifies the strength value of the key\&. The strength is a number between 0 and 15, and currently has no defined purpose in DNSSEC\&. .RE .PP \-T \fIrrtype\fR .RS 4 -Specifies the resource record type to use for the key. +Specifies the resource record type to use for the key\&. \fBrrtype\fR -must be either DNSKEY or KEY. The default is DNSKEY when using a DNSSEC algorithm, but it can be overridden to KEY for use with SIG(0). -Using any TSIG algorithm (HMAC\-* or DH) forces this option to KEY. +must be either DNSKEY or KEY\&. The default is DNSKEY when using a DNSSEC algorithm, but it can be overridden to KEY for use with SIG(0)\&. +Using any TSIG algorithm (HMAC\-* or DH) forces this option to KEY\&. .RE .PP \-t \fItype\fR .RS 4 -Indicates the use of the key. +Indicates the use of the key\&. \fBtype\fR -must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data. +must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF\&. The default is AUTHCONF\&. AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data\&. .RE .PP \-v \fIlevel\fR .RS 4 -Sets the debugging level. +Sets the debugging level\&. .RE .PP \-V .RS 4 -Prints version information. +Prints version information\&. .RE .SH "TIMING OPTIONS" .PP -Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '\-', it is interpreted as an offset from the present time. For convenience, if such an offset is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds. To explicitly prevent a date from being set, use 'none' or 'never'. +Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argument begins with a \*(Aq+\*(Aq or \*(Aq\-\*(Aq, it is interpreted as an offset from the present time\&. For convenience, if such an offset is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively\&. Without a suffix, the offset is computed in seconds\&. To explicitly prevent a date from being set, use \*(Aqnone\*(Aq or \*(Aqnever\*(Aq\&. .PP \-P \fIdate/offset\fR .RS 4 -Sets the date on which a key is to be published to the zone. After that date, the key will be included in the zone but will not be used to sign it. If not set, and if the \-G option has not been used, the default is "now". +Sets the date on which a key is to be published to the zone\&. After that date, the key will be included in the zone but will not be used to sign it\&. If not set, and if the \-G option has not been used, the default is "now"\&. .RE .PP \-A \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be activated. After that date, the key will be included in the zone and used to sign it. If not set, and if the \-G option has not been used, the default is "now". If set, if and \-P is not set, then the publication date will be set to the activation date minus the prepublication interval. +Sets the date on which the key is to be activated\&. After that date, the key will be included in the zone and used to sign it\&. If not set, and if the \-G option has not been used, the default is "now"\&. If set, if and \-P is not set, then the publication date will be set to the activation date minus the prepublication interval\&. .RE .PP \-R \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be revoked. After that date, the key will be flagged as revoked. It will be included in the zone and will be used to sign it. +Sets the date on which the key is to be revoked\&. After that date, the key will be flagged as revoked\&. It will be included in the zone and will be used to sign it\&. .RE .PP \-I \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be retired. After that date, the key will still be included in the zone, but it will not be used to sign it. +Sets the date on which the key is to be retired\&. After that date, the key will still be included in the zone, but it will not be used to sign it\&. .RE .PP \-D \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be deleted. After that date, the key will no longer be included in the zone. (It may remain in the key repository, however.) +Sets the date on which the key is to be deleted\&. After that date, the key will no longer be included in the zone\&. (It may remain in the key repository, however\&.) .RE .PP \-i \fIinterval\fR .RS 4 -Sets the prepublication interval for a key. If set, then the publication and activation dates must be separated by at least this much time. If the activation date is specified but the publication date isn't, then the publication date will default to this much time before the activation date; conversely, if the publication date is specified but activation date isn't, then activation will be set to this much time after publication. +Sets the prepublication interval for a key\&. If set, then the publication and activation dates must be separated by at least this much time\&. If the activation date is specified but the publication date isn\*(Aqt, then the publication date will default to this much time before the activation date; conversely, if the publication date is specified but activation date isn\*(Aqt, then activation will be set to this much time after publication\&. .sp -If the key is being created as an explicit successor to another key, then the default prepublication interval is 30 days; otherwise it is zero. +If the key is being created as an explicit successor to another key, then the default prepublication interval is 30 days; otherwise it is zero\&. .sp -As with date offsets, if the argument is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the interval is measured in years, months, weeks, days, hours, or minutes, respectively. Without a suffix, the interval is measured in seconds. +As with date offsets, if the argument is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the interval is measured in years, months, weeks, days, hours, or minutes, respectively\&. Without a suffix, the interval is measured in seconds\&. .RE .SH "GENERATED KEYS" .PP When \fBdnssec\-keygen\fR completes successfully, it prints a string of the form -\fIKnnnn.+aaa+iiiii\fR -to the standard output. This is an identification string for the key it has generated. -.TP 4 -\(bu -\fInnnn\fR -is the key name. -.TP 4 -\(bu -\fIaaa\fR -is the numeric representation of the algorithm. -.TP 4 -\(bu -\fIiiiii\fR -is the key identifier (or footprint). +Knnnn\&.+aaa+iiiii +to the standard output\&. This is an identification string for the key it has generated\&. +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +nnnn +is the key name\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +aaa +is the numeric representation of the algorithm\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +iiiii +is the key identifier (or footprint)\&. +.RE .PP \fBdnssec\-keygen\fR -creates two files, with names based on the printed string. -\fIKnnnn.+aaa+iiiii.key\fR +creates two files, with names based on the printed string\&. +Knnnn\&.+aaa+iiiii\&.key contains the public key, and -\fIKnnnn.+aaa+iiiii.private\fR -contains the private key. +Knnnn\&.+aaa+iiiii\&.private +contains the private key\&. .PP The -\fI.key\fR -file contains a DNS KEY record that can be inserted into a zone file (directly or with a $INCLUDE statement). +\&.key +file contains a DNS KEY record that can be inserted into a zone file (directly or with a $INCLUDE statement)\&. .PP The -\fI.private\fR -file contains algorithm\-specific fields. For obvious security reasons, this file does not have general read permission. +\&.private +file contains algorithm\-specific fields\&. For obvious security reasons, this file does not have general read permission\&. .PP Both -\fI.key\fR +\&.key and -\fI.private\fR -files are generated for symmetric encryption algorithms such as HMAC\-MD5, even though the public and private key are equivalent. +\&.private +files are generated for symmetric encryption algorithms such as HMAC\-MD5, even though the public and private key are equivalent\&. .SH "EXAMPLE" .PP To generate a 768\-bit DSA key for the domain -\fBexample.com\fR, the following command would be issued: +\fBexample\&.com\fR, the following command would be issued: .PP -\fBdnssec\-keygen \-a DSA \-b 768 \-n ZONE example.com\fR +\fBdnssec\-keygen \-a DSA \-b 768 \-n ZONE example\&.com\fR .PP The command would print a string of the form: .PP -\fBKexample.com.+003+26160\fR +\fBKexample\&.com\&.+003+26160\fR .PP In this example, \fBdnssec\-keygen\fR creates the files -\fIKexample.com.+003+26160.key\fR +Kexample\&.com\&.+003+26160\&.key and -\fIKexample.com.+003+26160.private\fR. +Kexample\&.com\&.+003+26160\&.private\&. .SH "SEE ALSO" .PP -\fBdnssec\-signzone\fR(8), +\fBdnssec-signzone\fR(8), BIND 9 Administrator Reference Manual, RFC 2539, RFC 2845, -RFC 4034. +RFC 4034\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007\-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br -Copyright \(co 2000\-2003 Internet Software Consortium. +Copyright \(co 2004, 2005, 2007-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2000-2003 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/dnssec/dnssec-keygen.docbook b/contrib/bind9/bin/dnssec/dnssec-keygen.docbook index 472575f0d..4737f5a82 100644 --- a/contrib/bind9/bin/dnssec/dnssec-keygen.docbook +++ b/contrib/bind9/bin/dnssec/dnssec-keygen.docbook @@ -1,6 +1,3 @@ -]> - + + + + 2014-02-07 + - February 07, 2014 + ISC + Internet Systems Consortium, Inc. @@ -58,43 +60,43 @@ - + dnssec-keygen - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - name + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + name - - DESCRIPTION + DESCRIPTION + dnssec-keygen generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with @@ -106,10 +108,10 @@ line. For DNSSEC keys, this must match the name of the zone for which the key is being generated. - + + + OPTIONS - - OPTIONS @@ -431,10 +433,10 @@ - + + + TIMING OPTIONS - - TIMING OPTIONS Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. @@ -522,7 +524,7 @@ If the key is being created as an explicit successor to another - key, then the default prepublication interval is 30 days; + key, then the default prepublication interval is 30 days; otherwise it is zero. @@ -536,11 +538,11 @@ - + - - GENERATED KEYS + GENERATED KEYS + When dnssec-keygen completes successfully, @@ -565,7 +567,7 @@ - dnssec-keygen + dnssec-keygen creates two files, with names based on the printed string. Knnnn.+aaa+iiiii.key contains the public key, and @@ -590,10 +592,10 @@ files are generated for symmetric encryption algorithms such as HMAC-MD5, even though the public and private key are equivalent. - + + + EXAMPLE - - EXAMPLE To generate a 768-bit DSA key for the domain example.com, the following command would be @@ -612,10 +614,10 @@ and Kexample.com.+003+26160.private. - + + + SEE ALSO - - SEE ALSO dnssec-signzone8 , @@ -624,16 +626,6 @@ RFC 2845, RFC 4034. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/dnssec/dnssec-keygen.html b/contrib/bind9/bin/dnssec/dnssec-keygen.html index 9cf62ebc7..a8917a374 100644 --- a/contrib/bind9/bin/dnssec/dnssec-keygen.html +++ b/contrib/bind9/bin/dnssec/dnssec-keygen.html @@ -14,14 +14,13 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dnssec-keygen - + -
    +

    Name

    @@ -31,9 +30,9 @@

    Synopsis

    dnssec-keygen [-a algorithm] [-b keysize] [-n nametype] [-3] [-A date/offset] [-C] [-c class] [-D date/offset] [-E engine] [-f flag] [-G] [-g generator] [-h] [-I date/offset] [-i interval] [-K directory] [-L ttl] [-k] [-P date/offset] [-p protocol] [-q] [-R date/offset] [-r randomdev] [-S key] [-s strength] [-t type] [-v level] [-V] [-z] {name}

    -
    -

    DESCRIPTION

    -

    dnssec-keygen +

    +

    DESCRIPTION

    +

    dnssec-keygen generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY @@ -45,9 +44,9 @@ which the key is being generated.

    -
    -

    OPTIONS

    -
    +
    +

    OPTIONS

    +
    -a algorithm

    @@ -120,7 +119,7 @@

    -C

    Compatibility mode: generates an old-style key, without - any metadata. By default, dnssec-keygen + any metadata. By default, dnssec-keygen will include the key's creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc). Keys that include @@ -159,7 +158,7 @@

    -h

    Prints a short summary of the options and arguments to - dnssec-keygen. + dnssec-keygen.

    -K directory

    @@ -191,7 +190,7 @@

    Quiet mode: Suppresses unnecessary output, including progress indication. Without this option, when - dnssec-keygen is run interactively + dnssec-keygen is run interactively to generate an RSA or DSA key pair, it will print a string of symbols to stderr indicating the progress of the key generation. A '.' indicates that a @@ -261,8 +260,8 @@

    -
    -

    TIMING OPTIONS

    +
    +

    TIMING OPTIONS

    Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -274,7 +273,7 @@ is computed in seconds. To explicitly prevent a date from being set, use 'none' or 'never'.

    -
    +
    -P date/offset

    Sets the date on which a key is to be published to the zone. @@ -322,7 +321,7 @@

    If the key is being created as an explicit successor to another - key, then the default prepublication interval is 30 days; + key, then the default prepublication interval is 30 days; otherwise it is zero.

    @@ -335,27 +334,27 @@

    -
    -

    GENERATED KEYS

    +
    +

    GENERATED KEYS

    - When dnssec-keygen completes + When dnssec-keygen completes successfully, it prints a string of the form Knnnn.+aaa+iiiii to the standard output. This is an identification string for the key it has generated.

    -
      -

    • nnnn is the key name. +

        +

      • nnnn is the key name.

        • -

      • aaa is the numeric representation +

      • aaa is the numeric representation of the algorithm.

        • -

      • iiiii is the key identifier (or +

      • iiiii is the key identifier (or footprint).

      -

      dnssec-keygen +

      dnssec-keygen creates two files, with names based on the printed string. Knnnn.+aaa+iiiii.key contains the public key, and @@ -381,8 +380,8 @@ HMAC-MD5, even though the public and private key are equivalent.

    -
    -

    EXAMPLE

    +
    +

    EXAMPLE

    To generate a 768-bit DSA key for the domain example.com, the following command would be @@ -396,14 +395,14 @@

    Kexample.com.+003+26160

    - In this example, dnssec-keygen creates + In this example, dnssec-keygen creates the files Kexample.com.+003+26160.key and Kexample.com.+003+26160.private.

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 2539, @@ -411,10 +410,5 @@ RFC 4034.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/dnssec/dnssec-revoke.8 b/contrib/bind9/bin/dnssec/dnssec-revoke.8 index eb8754557..15ac846aa 100644 --- a/contrib/bind9/bin/dnssec/dnssec-revoke.8 +++ b/contrib/bind9/bin/dnssec/dnssec-revoke.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2009, 2011, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2009, 2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,82 +12,95 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: dnssec\-revoke -.\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: October 20, 2011 +'\" t +.\" Title: dnssec-revoke +.\" Author: [FIXME: author] [see http://docbook.sf.net/el/author] +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2011-10-20 .\" Manual: BIND9 .\" Source: BIND9 +.\" Language: English .\" -.TH "DNSSEC\-REVOKE" "8" "October 20, 2011" "BIND9" "BIND9" +.TH "DNSSEC\-REVOKE" "8" "2011\-10\-20" "BIND9" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -dnssec\-revoke \- Set the REVOKED bit on a DNSSEC key +dnssec-revoke \- Set the REVOKED bit on a DNSSEC key .SH "SYNOPSIS" -.HP 14 +.HP \w'\fBdnssec\-revoke\fR\ 'u \fBdnssec\-revoke\fR [\fB\-hr\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\fR] [\fB\-R\fR] {keyfile} .SH "DESCRIPTION" .PP \fBdnssec\-revoke\fR -reads a DNSSEC key file, sets the REVOKED bit on the key as defined in RFC 5011, and creates a new pair of key files containing the now\-revoked key. +reads a DNSSEC key file, sets the REVOKED bit on the key as defined in RFC 5011, and creates a new pair of key files containing the now\-revoked key\&. .SH "OPTIONS" .PP \-h .RS 4 -Emit usage message and exit. +Emit usage message and exit\&. .RE .PP \-K \fIdirectory\fR .RS 4 -Sets the directory in which the key files are to reside. +Sets the directory in which the key files are to reside\&. .RE .PP \-r .RS 4 -After writing the new keyset files remove the original keyset files. +After writing the new keyset files remove the original keyset files\&. .RE .PP \-v \fIlevel\fR .RS 4 -Sets the debugging level. +Sets the debugging level\&. .RE .PP \-V .RS 4 -Prints version information. +Prints version information\&. .RE .PP \-E \fIengine\fR .RS 4 -Use the given OpenSSL engine. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine. +Use the given OpenSSL engine\&. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine\&. .RE .PP \-f .RS 4 Force overwrite: Causes \fBdnssec\-revoke\fR -to write the new key pair even if a file already exists matching the algorithm and key ID of the revoked key. +to write the new key pair even if a file already exists matching the algorithm and key ID of the revoked key\&. .RE .PP \-R .RS 4 -Print the key tag of the key with the REVOKE bit set but do not revoke the key. +Print the key tag of the key with the REVOKE bit set but do not revoke the key\&. .RE .SH "SEE ALSO" .PP -\fBdnssec\-keygen\fR(8), +\fBdnssec-keygen\fR(8), BIND 9 Administrator Reference Manual, -RFC 5011. -.SH "AUTHOR" -.PP -Internet Systems Consortium +RFC 5011\&. .SH "COPYRIGHT" -Copyright \(co 2009, 2011, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2009, 2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/dnssec/dnssec-revoke.c b/contrib/bind9/bin/dnssec/dnssec-revoke.c index 6756a3812..4e2a18a93 100644 --- a/contrib/bind9/bin/dnssec/dnssec-revoke.c +++ b/contrib/bind9/bin/dnssec/dnssec-revoke.c @@ -79,7 +79,8 @@ main(int argc, char **argv) { #else const char *engine = NULL; #endif - char *filename = NULL, *dir = NULL; + char const *filename = NULL; + char *dir = NULL; char newname[1024], oldname[1024]; char keystr[DST_KEY_FORMATSIZE]; char *endp; diff --git a/contrib/bind9/bin/dnssec/dnssec-revoke.docbook b/contrib/bind9/bin/dnssec/dnssec-revoke.docbook index 85463d682..19708d2b3 100644 --- a/contrib/bind9/bin/dnssec/dnssec-revoke.docbook +++ b/contrib/bind9/bin/dnssec/dnssec-revoke.docbook @@ -1,8 +1,5 @@ -]> - - - October 20, 2011 - + + + + 2011-10-20 + dnssec-revoke @@ -38,35 +36,36 @@ 2009 2011 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") - + dnssec-revoke - - - - - - - - keyfile + + + + + + + + keyfile - - DESCRIPTION + DESCRIPTION + dnssec-revoke reads a DNSSEC key file, sets the REVOKED bit on the key as defined in RFC 5011, and creates a new pair of key files containing the now-revoked key. - + + + OPTIONS - - OPTIONS @@ -77,7 +76,7 @@ - + -K directory @@ -146,26 +145,16 @@ - + + + SEE ALSO - - SEE ALSO dnssec-keygen8 , BIND 9 Administrator Reference Manual, RFC 5011. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/dnssec/dnssec-revoke.html b/contrib/bind9/bin/dnssec/dnssec-revoke.html index d09b7dcd3..58bbdae41 100644 --- a/contrib/bind9/bin/dnssec/dnssec-revoke.html +++ b/contrib/bind9/bin/dnssec/dnssec-revoke.html @@ -1,5 +1,5 @@ - dnssec-revoke - + -
    +

    Name

    @@ -30,17 +29,17 @@

    Synopsis

    dnssec-revoke [-hr] [-v level] [-V] [-K directory] [-E engine] [-f] [-R] {keyfile}

    -
    -

    DESCRIPTION

    -

    dnssec-revoke +

    +

    DESCRIPTION

    +

    dnssec-revoke reads a DNSSEC key file, sets the REVOKED bit on the key as defined in RFC 5011, and creates a new pair of key files containing the now-revoked key.

    -
    -

    OPTIONS

    -
    +
    +

    OPTIONS

    +
    -h

    Emit usage message and exit. @@ -69,7 +68,7 @@

    -f

    - Force overwrite: Causes dnssec-revoke to + Force overwrite: Causes dnssec-revoke to write the new key pair even if a file already exists matching the algorithm and key ID of the revoked key.

    @@ -80,17 +79,12 @@

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    dnssec-keygen(8), BIND 9 Administrator Reference Manual, RFC 5011.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.8 b/contrib/bind9/bin/dnssec/dnssec-settime.8 index 821e4db99..37951ad2e 100644 --- a/contrib/bind9/bin/dnssec/dnssec-settime.8 +++ b/contrib/bind9/bin/dnssec/dnssec-settime.8 @@ -12,26 +12,41 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: dnssec\-settime +'\" t +.\" Title: dnssec-settime .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: February 07, 2014 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2014-02-07 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "DNSSEC\-SETTIME" "8" "February 07, 2014" "BIND9" "BIND9" +.TH "DNSSEC\-SETTIME" "8" "2014\-02\-07" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -dnssec\-settime \- Set the key timing metadata for a DNSSEC key +dnssec-settime \- Set the key timing metadata for a DNSSEC key .SH "SYNOPSIS" -.HP 15 +.HP \w'\fBdnssec\-settime\fR\ 'u \fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] {keyfile} .SH "DESCRIPTION" .PP @@ -42,114 +57,114 @@ reads a DNSSEC private key file and sets the key timing metadata as specified by \fB\-R\fR, \fB\-I\fR, and \fB\-D\fR -options. The metadata can then be used by +options\&. The metadata can then be used by \fBdnssec\-signzone\fR -or other signing software to determine when a key is to be published, whether it should be used for signing a zone, etc. +or other signing software to determine when a key is to be published, whether it should be used for signing a zone, etc\&. .PP If none of these options is set on the command line, then \fBdnssec\-settime\fR -simply prints the key timing metadata already stored in the key. +simply prints the key timing metadata already stored in the key\&. .PP -When key metadata fields are changed, both files of a key pair (\fIKnnnn.+aaa+iiiii.key\fR +When key metadata fields are changed, both files of a key pair (Knnnn\&.+aaa+iiiii\&.key and -\fIKnnnn.+aaa+iiiii.private\fR) are regenerated. Metadata fields are stored in the private file. A human\-readable description of the metadata is also placed in comments in the key file. The private file's permissions are always set to be inaccessible to anyone other than the owner (mode 0600). +Knnnn\&.+aaa+iiiii\&.private) are regenerated\&. Metadata fields are stored in the private file\&. A human\-readable description of the metadata is also placed in comments in the key file\&. The private file\*(Aqs permissions are always set to be inaccessible to anyone other than the owner (mode 0600)\&. .SH "OPTIONS" .PP \-f .RS 4 -Force an update of an old\-format key with no metadata fields. Without this option, +Force an update of an old\-format key with no metadata fields\&. Without this option, \fBdnssec\-settime\fR -will fail when attempting to update a legacy key. With this option, the key will be recreated in the new format, but with the original key data retained. The key's creation date will be set to the present time. If no other values are specified, then the key's publication and activation dates will also be set to the present time. +will fail when attempting to update a legacy key\&. With this option, the key will be recreated in the new format, but with the original key data retained\&. The key\*(Aqs creation date will be set to the present time\&. If no other values are specified, then the key\*(Aqs publication and activation dates will also be set to the present time\&. .RE .PP \-K \fIdirectory\fR .RS 4 -Sets the directory in which the key files are to reside. +Sets the directory in which the key files are to reside\&. .RE .PP \-L \fIttl\fR .RS 4 -Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL. Setting the default TTL to +Sets the default TTL to use for this key when it is converted into a DNSKEY RR\&. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence\&. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL\&. Setting the default TTL to 0 or none -removes it from the key. +removes it from the key\&. .RE .PP \-h .RS 4 -Emit usage message and exit. +Emit usage message and exit\&. .RE .PP \-V .RS 4 -Prints version information. +Prints version information\&. .RE .PP \-v \fIlevel\fR .RS 4 -Sets the debugging level. +Sets the debugging level\&. .RE .PP \-E \fIengine\fR .RS 4 -Use the given OpenSSL engine. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine. +Use the given OpenSSL engine\&. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine\&. .RE .SH "TIMING OPTIONS" .PP -Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '\-', it is interpreted as an offset from the present time. For convenience, if such an offset is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds. To unset a date, use 'none' or 'never'. +Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argument begins with a \*(Aq+\*(Aq or \*(Aq\-\*(Aq, it is interpreted as an offset from the present time\&. For convenience, if such an offset is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively\&. Without a suffix, the offset is computed in seconds\&. To unset a date, use \*(Aqnone\*(Aq or \*(Aqnever\*(Aq\&. .PP \-P \fIdate/offset\fR .RS 4 -Sets the date on which a key is to be published to the zone. After that date, the key will be included in the zone but will not be used to sign it. +Sets the date on which a key is to be published to the zone\&. After that date, the key will be included in the zone but will not be used to sign it\&. .RE .PP \-A \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be activated. After that date, the key will be included in the zone and used to sign it. +Sets the date on which the key is to be activated\&. After that date, the key will be included in the zone and used to sign it\&. .RE .PP \-R \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be revoked. After that date, the key will be flagged as revoked. It will be included in the zone and will be used to sign it. +Sets the date on which the key is to be revoked\&. After that date, the key will be flagged as revoked\&. It will be included in the zone and will be used to sign it\&. .RE .PP \-I \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be retired. After that date, the key will still be included in the zone, but it will not be used to sign it. +Sets the date on which the key is to be retired\&. After that date, the key will still be included in the zone, but it will not be used to sign it\&. .RE .PP \-D \fIdate/offset\fR .RS 4 -Sets the date on which the key is to be deleted. After that date, the key will no longer be included in the zone. (It may remain in the key repository, however.) +Sets the date on which the key is to be deleted\&. After that date, the key will no longer be included in the zone\&. (It may remain in the key repository, however\&.) .RE .PP \-S \fIpredecessor key\fR .RS 4 -Select a key for which the key being modified will be an explicit successor. The name, algorithm, size, and type of the predecessor key must exactly match those of the key being modified. The activation date of the successor key will be set to the inactivation date of the predecessor. The publication date will be set to the activation date minus the prepublication interval, which defaults to 30 days. +Select a key for which the key being modified will be an explicit successor\&. The name, algorithm, size, and type of the predecessor key must exactly match those of the key being modified\&. The activation date of the successor key will be set to the inactivation date of the predecessor\&. The publication date will be set to the activation date minus the prepublication interval, which defaults to 30 days\&. .RE .PP \-i \fIinterval\fR .RS 4 -Sets the prepublication interval for a key. If set, then the publication and activation dates must be separated by at least this much time. If the activation date is specified but the publication date isn't, then the publication date will default to this much time before the activation date; conversely, if the publication date is specified but activation date isn't, then activation will be set to this much time after publication. +Sets the prepublication interval for a key\&. If set, then the publication and activation dates must be separated by at least this much time\&. If the activation date is specified but the publication date isn\*(Aqt, then the publication date will default to this much time before the activation date; conversely, if the publication date is specified but activation date isn\*(Aqt, then activation will be set to this much time after publication\&. .sp -If the key is being set to be an explicit successor to another key, then the default prepublication interval is 30 days; otherwise it is zero. +If the key is being set to be an explicit successor to another key, then the default prepublication interval is 30 days; otherwise it is zero\&. .sp -As with date offsets, if the argument is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the interval is measured in years, months, weeks, days, hours, or minutes, respectively. Without a suffix, the interval is measured in seconds. +As with date offsets, if the argument is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the interval is measured in years, months, weeks, days, hours, or minutes, respectively\&. Without a suffix, the interval is measured in seconds\&. .RE .SH "PRINTING OPTIONS" .PP \fBdnssec\-settime\fR -can also be used to print the timing metadata associated with a key. +can also be used to print the timing metadata associated with a key\&. .PP \-u .RS 4 -Print times in UNIX epoch format. +Print times in UNIX epoch format\&. .RE .PP \-p \fIC/P/A/R/I/D/all\fR .RS 4 -Print a specific metadata value or set of metadata values. The +Print a specific metadata value or set of metadata values\&. The \fB\-p\fR option may be followed by one or more of the following letters to indicate which value or values to print: \fBC\fR @@ -163,18 +178,19 @@ for the revocation date, \fBI\fR for the inactivation date, or \fBD\fR -for the deletion date. To print all of the metadata, use -\fB\-p all\fR. +for the deletion date\&. To print all of the metadata, use +\fB\-p all\fR\&. .RE .SH "SEE ALSO" .PP -\fBdnssec\-keygen\fR(8), -\fBdnssec\-signzone\fR(8), +\fBdnssec-keygen\fR(8), +\fBdnssec-signzone\fR(8), BIND 9 Administrator Reference Manual, -RFC 5011. +RFC 5011\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2009\-2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2009-2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.c b/contrib/bind9/bin/dnssec/dnssec-settime.c index e26356c78..a95d39a23 100644 --- a/contrib/bind9/bin/dnssec/dnssec-settime.c +++ b/contrib/bind9/bin/dnssec/dnssec-settime.c @@ -122,7 +122,8 @@ main(int argc, char **argv) { #else const char *engine = NULL; #endif - char *filename = NULL, *directory = NULL; + const char *filename = NULL; + char *directory = NULL; char newname[1024]; char keystr[DST_KEY_FORMATSIZE]; char *endp, *p; diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.docbook b/contrib/bind9/bin/dnssec/dnssec-settime.docbook index 942f1889c..db2b90a1c 100644 --- a/contrib/bind9/bin/dnssec/dnssec-settime.docbook +++ b/contrib/bind9/bin/dnssec/dnssec-settime.docbook @@ -1,6 +1,3 @@ -]> - + + + + 2014-02-07 + - February 07, 2014 + ISC + Internet Systems Consortium, Inc. @@ -45,26 +47,26 @@ - + dnssec-settime - - - - - - - - - - - - - keyfile + + + + + + + + + + + + + keyfile - - DESCRIPTION + DESCRIPTION + dnssec-settime reads a DNSSEC private key file and sets the key timing metadata as specified by the , , @@ -88,10 +90,10 @@ file. The private file's permissions are always set to be inaccessible to anyone other than the owner (mode 0600). - + + + OPTIONS - - OPTIONS @@ -103,13 +105,13 @@ fail when attempting to update a legacy key. With this option, the key will be recreated in the new format, but with the original key data retained. The key's creation date will be - set to the present time. If no other values are specified, - then the key's publication and activation dates will also + set to the present time. If no other values are specified, + then the key's publication and activation dates will also be set to the present time. - + -K directory @@ -143,7 +145,7 @@ - + -V @@ -172,10 +174,10 @@ - + + + TIMING OPTIONS - - TIMING OPTIONS Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -272,7 +274,7 @@ If the key is being set to be an explicit successor to another - key, then the default prepublication interval is 30 days; + key, then the default prepublication interval is 30 days; otherwise it is zero. @@ -285,10 +287,10 @@ - + + + PRINTING OPTIONS - - PRINTING OPTIONS dnssec-settime can also be used to print the timing metadata associated with a key. @@ -323,10 +325,10 @@ - + + + SEE ALSO - - SEE ALSO dnssec-keygen8 , @@ -336,16 +338,6 @@ BIND 9 Administrator Reference Manual, RFC 5011. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/dnssec/dnssec-settime.html b/contrib/bind9/bin/dnssec/dnssec-settime.html index 0132e07ce..d66bf73e3 100644 --- a/contrib/bind9/bin/dnssec/dnssec-settime.html +++ b/contrib/bind9/bin/dnssec/dnssec-settime.html @@ -13,14 +13,13 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dnssec-settime - + -
    +

    Name

    @@ -30,20 +29,20 @@

    Synopsis

    dnssec-settime [-f] [-K directory] [-L ttl] [-P date/offset] [-A date/offset] [-R date/offset] [-I date/offset] [-D date/offset] [-h] [-V] [-v level] [-E engine] {keyfile}

    -
    -

    DESCRIPTION

    -

    dnssec-settime +

    +

    DESCRIPTION

    +

    dnssec-settime reads a DNSSEC private key file and sets the key timing metadata as specified by the -P, -A, -R, -I, and -D options. The metadata can then be used by - dnssec-signzone or other signing software to + dnssec-signzone or other signing software to determine when a key is to be published, whether it should be used for signing a zone, etc.

    If none of these options is set on the command line, - then dnssec-settime simply prints the key timing + then dnssec-settime simply prints the key timing metadata already stored in the key.

    @@ -56,18 +55,18 @@ inaccessible to anyone other than the owner (mode 0600).

    -
    -

    OPTIONS

    -
    +
    +

    OPTIONS

    +
    -f

    Force an update of an old-format key with no metadata fields. - Without this option, dnssec-settime will + Without this option, dnssec-settime will fail when attempting to update a legacy key. With this option, the key will be recreated in the new format, but with the original key data retained. The key's creation date will be - set to the present time. If no other values are specified, - then the key's publication and activation dates will also + set to the present time. If no other values are specified, + then the key's publication and activation dates will also be set to the present time.

    -K directory
    @@ -104,8 +103,8 @@

    -
    -

    TIMING OPTIONS

    +
    +

    TIMING OPTIONS

    Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -116,7 +115,7 @@ days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds. To unset a date, use 'none' or 'never'.

    -
    +
    -P date/offset

    Sets the date on which a key is to be published to the zone. @@ -170,7 +169,7 @@

    If the key is being set to be an explicit successor to another - key, then the default prepublication interval is 30 days; + key, then the default prepublication interval is 30 days; otherwise it is zero.

    @@ -183,13 +182,13 @@

    -
    -

    PRINTING OPTIONS

    +
    +

    PRINTING OPTIONS

    - dnssec-settime can also be used to print the + dnssec-settime can also be used to print the timing metadata associated with a key.

    -
    +
    -u

    Print times in UNIX epoch format. @@ -209,18 +208,13 @@

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 5011.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.8 b/contrib/bind9/bin/dnssec/dnssec-signzone.8 index be2f5b34e..214bb5512 100644 --- a/contrib/bind9/bin/dnssec/dnssec-signzone.8 +++ b/contrib/bind9/bin/dnssec/dnssec-signzone.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2009, 2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2009, 2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000-2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,438 +13,458 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: dnssec\-signzone +'\" t +.\" Title: dnssec-signzone .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: December 11, 2013 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2013-12-11 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "DNSSEC\-SIGNZONE" "8" "December 11, 2013" "BIND9" "BIND9" +.TH "DNSSEC\-SIGNZONE" "8" "2013\-12\-11" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -dnssec\-signzone \- DNSSEC zone signing tool +dnssec-signzone \- DNSSEC zone signing tool .SH "SYNOPSIS" -.HP 16 +.HP \w'\fBdnssec\-signzone\fR\ 'u \fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-p\fR] [\fB\-R\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...] .SH "DESCRIPTION" .PP \fBdnssec\-signzone\fR -signs a zone. It generates NSEC and RRSIG records and produces a signed version of the zone. The security status of delegations from the signed zone (that is, whether the child zones are secure or not) is determined by the presence or absence of a -\fIkeyset\fR -file for each child zone. +signs a zone\&. It generates NSEC and RRSIG records and produces a signed version of the zone\&. The security status of delegations from the signed zone (that is, whether the child zones are secure or not) is determined by the presence or absence of a +keyset +file for each child zone\&. .SH "OPTIONS" .PP \-a .RS 4 -Verify all generated signatures. +Verify all generated signatures\&. .RE .PP \-c \fIclass\fR .RS 4 -Specifies the DNS class of the zone. +Specifies the DNS class of the zone\&. .RE .PP \-C .RS 4 Compatibility mode: Generate a -\fIkeyset\-\fR\fI\fIzonename\fR\fR +keyset\-\fIzonename\fR file in addition to -\fIdsset\-\fR\fI\fIzonename\fR\fR +dsset\-\fIzonename\fR when signing a zone, for use by older versions of -\fBdnssec\-signzone\fR. +\fBdnssec\-signzone\fR\&. .RE .PP \-d \fIdirectory\fR .RS 4 Look for -\fIdsset\-\fR +dsset\- or -\fIkeyset\-\fR +keyset\- files in -\fBdirectory\fR. +\fBdirectory\fR\&. .RE .PP \-D .RS 4 Output only those record types automatically managed by -\fBdnssec\-signzone\fR, i.e. RRSIG, NSEC, NSEC3 and NSEC3PARAM records. If smart signing (\fB\-S\fR) is used, DNSKEY records are also included. The resulting file can be included in the original zone file with -\fB$INCLUDE\fR. This option cannot be combined with +\fBdnssec\-signzone\fR, i\&.e\&. RRSIG, NSEC, NSEC3 and NSEC3PARAM records\&. If smart signing (\fB\-S\fR) is used, DNSKEY records are also included\&. The resulting file can be included in the original zone file with +\fB$INCLUDE\fR\&. This option cannot be combined with \fB\-O raw\fR -or serial number updating. +or serial number updating\&. .RE .PP \-E \fIengine\fR .RS 4 -Uses a crypto hardware (OpenSSL engine) for the crypto operations it supports, for instance signing with private keys from a secure key store. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine. +Uses a crypto hardware (OpenSSL engine) for the crypto operations it supports, for instance signing with private keys from a secure key store\&. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine\&. .RE .PP \-g .RS 4 Generate DS records for child zones from -\fIdsset\-\fR +dsset\- or -\fIkeyset\-\fR -file. Existing DS records will be removed. +keyset\- +file\&. Existing DS records will be removed\&. .RE .PP \-K \fIdirectory\fR .RS 4 -Key repository: Specify a directory to search for DNSSEC keys. If not specified, defaults to the current directory. +Key repository: Specify a directory to search for DNSSEC keys\&. If not specified, defaults to the current directory\&. .RE .PP \-k \fIkey\fR .RS 4 -Treat specified key as a key signing key ignoring any key flags. This option may be specified multiple times. +Treat specified key as a key signing key ignoring any key flags\&. This option may be specified multiple times\&. .RE .PP \-l \fIdomain\fR .RS 4 -Generate a DLV set in addition to the key (DNSKEY) and DS sets. The domain is appended to the name of the records. +Generate a DLV set in addition to the key (DNSKEY) and DS sets\&. The domain is appended to the name of the records\&. .RE .PP \-s \fIstart\-time\fR .RS 4 -Specify the date and time when the generated RRSIG records become valid. This can be either an absolute or relative time. An absolute start time is indicated by a number in YYYYMMDDHHMMSS notation; 20000530144500 denotes 14:45:00 UTC on May 30th, 2000. A relative start time is indicated by +N, which is N seconds from the current time. If no +Specify the date and time when the generated RRSIG records become valid\&. This can be either an absolute or relative time\&. An absolute start time is indicated by a number in YYYYMMDDHHMMSS notation; 20000530144500 denotes 14:45:00 UTC on May 30th, 2000\&. A relative start time is indicated by +N, which is N seconds from the current time\&. If no \fBstart\-time\fR -is specified, the current time minus 1 hour (to allow for clock skew) is used. +is specified, the current time minus 1 hour (to allow for clock skew) is used\&. .RE .PP \-e \fIend\-time\fR .RS 4 -Specify the date and time when the generated RRSIG records expire. As with -\fBstart\-time\fR, an absolute time is indicated in YYYYMMDDHHMMSS notation. A time relative to the start time is indicated with +N, which is N seconds from the start time. A time relative to the current time is indicated with now+N. If no +Specify the date and time when the generated RRSIG records expire\&. As with +\fBstart\-time\fR, an absolute time is indicated in YYYYMMDDHHMMSS notation\&. A time relative to the start time is indicated with +N, which is N seconds from the start time\&. A time relative to the current time is indicated with now+N\&. If no \fBend\-time\fR -is specified, 30 days from the start time is used as a default. +is specified, 30 days from the start time is used as a default\&. \fBend\-time\fR must be later than -\fBstart\-time\fR. +\fBstart\-time\fR\&. .RE .PP \-X \fIextended end\-time\fR .RS 4 -Specify the date and time when the generated RRSIG records for the DNSKEY RRset will expire. This is to be used in cases when the DNSKEY signatures need to persist longer than signatures on other records; e.g., when the private component of the KSK is kept offline and the KSK signature is to be refreshed manually. +Specify the date and time when the generated RRSIG records for the DNSKEY RRset will expire\&. This is to be used in cases when the DNSKEY signatures need to persist longer than signatures on other records; e\&.g\&., when the private component of the KSK is kept offline and the KSK signature is to be refreshed manually\&. .sp As with -\fBstart\-time\fR, an absolute time is indicated in YYYYMMDDHHMMSS notation. A time relative to the start time is indicated with +N, which is N seconds from the start time. A time relative to the current time is indicated with now+N. If no +\fBstart\-time\fR, an absolute time is indicated in YYYYMMDDHHMMSS notation\&. A time relative to the start time is indicated with +N, which is N seconds from the start time\&. A time relative to the current time is indicated with now+N\&. If no \fBextended end\-time\fR is specified, the value of \fBend\-time\fR -is used as the default. (\fBend\-time\fR, in turn, defaults to 30 days from the start time.) +is used as the default\&. (\fBend\-time\fR, in turn, defaults to 30 days from the start time\&.) \fBextended end\-time\fR must be later than -\fBstart\-time\fR. +\fBstart\-time\fR\&. .RE .PP \-f \fIoutput\-file\fR .RS 4 -The name of the output file containing the signed zone. The default is to append -\fI.signed\fR -to the input filename. If +The name of the output file containing the signed zone\&. The default is to append +\&.signed +to the input filename\&. If \fBoutput\-file\fR is set to -"\-", then the signed zone is written to the standard output, with a default output format of "full". +"\-", then the signed zone is written to the standard output, with a default output format of "full"\&. .RE .PP \-h .RS 4 Prints a short summary of the options and arguments to -\fBdnssec\-signzone\fR. +\fBdnssec\-signzone\fR\&. .RE .PP \-V .RS 4 -Prints version information. +Prints version information\&. .RE .PP \-i \fIinterval\fR .RS 4 -When a previously\-signed zone is passed as input, records may be resigned. The +When a previously\-signed zone is passed as input, records may be resigned\&. The \fBinterval\fR -option specifies the cycle interval as an offset from the current time (in seconds). If a RRSIG record expires after the cycle interval, it is retained. Otherwise, it is considered to be expiring soon, and it will be replaced. +option specifies the cycle interval as an offset from the current time (in seconds)\&. If a RRSIG record expires after the cycle interval, it is retained\&. Otherwise, it is considered to be expiring soon, and it will be replaced\&. .sp -The default cycle interval is one quarter of the difference between the signature end and start times. So if neither +The default cycle interval is one quarter of the difference between the signature end and start times\&. So if neither \fBend\-time\fR or \fBstart\-time\fR are specified, \fBdnssec\-signzone\fR -generates signatures that are valid for 30 days, with a cycle interval of 7.5 days. Therefore, if any existing RRSIG records are due to expire in less than 7.5 days, they would be replaced. +generates signatures that are valid for 30 days, with a cycle interval of 7\&.5 days\&. Therefore, if any existing RRSIG records are due to expire in less than 7\&.5 days, they would be replaced\&. .RE .PP \-I \fIinput\-format\fR .RS 4 -The format of the input zone file. Possible formats are +The format of the input zone file\&. Possible formats are \fB"text"\fR (default) and -\fB"raw"\fR. This option is primarily intended to be used for dynamic signed zones so that the dumped zone file in a non\-text format containing updates can be signed directly. The use of this option does not make much sense for non\-dynamic zones. +\fB"raw"\fR\&. This option is primarily intended to be used for dynamic signed zones so that the dumped zone file in a non\-text format containing updates can be signed directly\&. The use of this option does not make much sense for non\-dynamic zones\&. .RE .PP \-j \fIjitter\fR .RS 4 -When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. a previously\-signed zone is passed as input to the signer, all expired signatures have to be regenerated at about the same time. The +When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously\&. If the zone is incrementally signed, i\&.e\&. a previously\-signed zone is passed as input to the signer, all expired signatures have to be regenerated at about the same time\&. The \fBjitter\fR -option specifies a jitter window that will be used to randomize the signature expire time, thus spreading incremental signature regeneration over time. +option specifies a jitter window that will be used to randomize the signature expire time, thus spreading incremental signature regeneration over time\&. .sp -Signature lifetime jitter also to some extent benefits validators and servers by spreading out cache expiration, i.e. if large numbers of RRSIGs don't expire at the same time from all caches there will be less congestion than if all validators need to refetch at mostly the same time. +Signature lifetime jitter also to some extent benefits validators and servers by spreading out cache expiration, i\&.e\&. if large numbers of RRSIGs don\*(Aqt expire at the same time from all caches there will be less congestion than if all validators need to refetch at mostly the same time\&. .RE .PP \-L \fIserial\fR .RS 4 -When writing a signed zone to 'raw' format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.) +When writing a signed zone to \*(Aqraw\*(Aq format, set the "source serial" value in the header to the specified serial number\&. (This is expected to be used primarily for testing purposes\&.) .RE .PP \-n \fIncpus\fR .RS 4 -Specifies the number of threads to use. By default, one thread is started for each detected CPU. +Specifies the number of threads to use\&. By default, one thread is started for each detected CPU\&. .RE .PP \-N \fIsoa\-serial\-format\fR .RS 4 -The SOA serial number format of the signed zone. Possible formats are +The SOA serial number format of the signed zone\&. Possible formats are \fB"keep"\fR (default), \fB"increment"\fR and -\fB"unixtime"\fR. -.RS 4 +\fB"unixtime"\fR\&. .PP \fB"keep"\fR .RS 4 -Do not modify the SOA serial number. +Do not modify the SOA serial number\&. .RE .PP \fB"increment"\fR .RS 4 -Increment the SOA serial number using RFC 1982 arithmetics. +Increment the SOA serial number using RFC 1982 arithmetics\&. .RE .PP \fB"unixtime"\fR .RS 4 -Set the SOA serial number to the number of seconds since epoch. -.RE +Set the SOA serial number to the number of seconds since epoch\&. .RE .RE .PP \-o \fIorigin\fR .RS 4 -The zone origin. If not specified, the name of the zone file is assumed to be the origin. +The zone origin\&. If not specified, the name of the zone file is assumed to be the origin\&. .RE .PP \-O \fIoutput\-format\fR .RS 4 -The format of the output file containing the signed zone. Possible formats are +The format of the output file containing the signed zone\&. Possible formats are \fB"text"\fR (default) \fB"full"\fR, which is text output in a format suitable for processing by external scripts, and \fB"raw"\fR or \fB"raw=N"\fR, which store the zone in a binary format for rapid loading by -\fBnamed\fR. +\fBnamed\fR\&. \fB"raw=N"\fR specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of -\fBnamed\fR; if N is 1, the file can be read by release 9.9.0 or higher. The default is 1. +\fBnamed\fR; if N is 1, the file can be read by release 9\&.9\&.0 or higher\&. The default is 1\&. .RE .PP \-p .RS 4 -Use pseudo\-random data when signing the zone. This is faster, but less secure, than using real random data. This option may be useful when signing large zones or when the entropy source is limited. +Use pseudo\-random data when signing the zone\&. This is faster, but less secure, than using real random data\&. This option may be useful when signing large zones or when the entropy source is limited\&. .RE .PP \-P .RS 4 -Disable post sign verification tests. +Disable post sign verification tests\&. .sp -The post sign verification test ensures that for each algorithm in use there is at least one non revoked self signed KSK key, that all revoked KSK keys are self signed, and that all records in the zone are signed by the algorithm. This option skips these tests. +The post sign verification test ensures that for each algorithm in use there is at least one non revoked self signed KSK key, that all revoked KSK keys are self signed, and that all records in the zone are signed by the algorithm\&. This option skips these tests\&. .RE .PP \-Q .RS 4 -Remove signatures from keys that are no longer active. +Remove signatures from keys that are no longer active\&. .sp -Normally, when a previously\-signed zone is passed as input to the signer, and a DNSKEY record has been removed and replaced with a new one, signatures from the old key that are still within their validity period are retained. This allows the zone to continue to validate with cached copies of the old DNSKEY RRset. The +Normally, when a previously\-signed zone is passed as input to the signer, and a DNSKEY record has been removed and replaced with a new one, signatures from the old key that are still within their validity period are retained\&. This allows the zone to continue to validate with cached copies of the old DNSKEY RRset\&. The \fB\-Q\fR forces \fBdnssec\-signzone\fR -to remove signatures from keys that are no longer active. This enables ZSK rollover using the procedure described in RFC 4641, section 4.2.1.1 ("Pre\-Publish Key Rollover"). +to remove signatures from keys that are no longer active\&. This enables ZSK rollover using the procedure described in RFC 4641, section 4\&.2\&.1\&.1 ("Pre\-Publish Key Rollover")\&. .RE .PP \-R .RS 4 -Remove signatures from keys that are no longer published. +Remove signatures from keys that are no longer published\&. .sp This option is similar to \fB\-Q\fR, except it forces \fBdnssec\-signzone\fR -to signatures from keys that are no longer published. This enables ZSK rollover using the procedure described in RFC 4641, section 4.2.1.2 ("Double Signature Zone Signing Key Rollover"). +to signatures from keys that are no longer published\&. This enables ZSK rollover using the procedure described in RFC 4641, section 4\&.2\&.1\&.2 ("Double Signature Zone Signing Key Rollover")\&. .RE .PP \-r \fIrandomdev\fR .RS 4 -Specifies the source of randomness. If the operating system does not provide a -\fI/dev/random\fR -or equivalent device, the default source of randomness is keyboard input. -\fIrandomdev\fR -specifies the name of a character device or file containing random data to be used instead of the default. The special value -\fIkeyboard\fR -indicates that keyboard input should be used. +Specifies the source of randomness\&. If the operating system does not provide a +/dev/random +or equivalent device, the default source of randomness is keyboard input\&. +randomdev +specifies the name of a character device or file containing random data to be used instead of the default\&. The special value +keyboard +indicates that keyboard input should be used\&. .RE .PP \-S .RS 4 Smart signing: Instructs \fBdnssec\-signzone\fR -to search the key repository for keys that match the zone being signed, and to include them in the zone if appropriate. +to search the key repository for keys that match the zone being signed, and to include them in the zone if appropriate\&. .sp -When a key is found, its timing metadata is examined to determine how it should be used, according to the following rules. Each successive rule takes priority over the prior ones: -.RS 4 +When a key is found, its timing metadata is examined to determine how it should be used, according to the following rules\&. Each successive rule takes priority over the prior ones: .PP .RS 4 -If no timing metadata has been set for the key, the key is published in the zone and used to sign the zone. +If no timing metadata has been set for the key, the key is published in the zone and used to sign the zone\&. .RE .PP .RS 4 -If the key's publication date is set and is in the past, the key is published in the zone. +If the key\*(Aqs publication date is set and is in the past, the key is published in the zone\&. .RE .PP .RS 4 -If the key's activation date is set and in the past, the key is published (regardless of publication date) and used to sign the zone. +If the key\*(Aqs activation date is set and in the past, the key is published (regardless of publication date) and used to sign the zone\&. .RE .PP .RS 4 -If the key's revocation date is set and in the past, and the key is published, then the key is revoked, and the revoked key is used to sign the zone. +If the key\*(Aqs revocation date is set and in the past, and the key is published, then the key is revoked, and the revoked key is used to sign the zone\&. .RE .PP .RS 4 -If either of the key's unpublication or deletion dates are set and in the past, the key is NOT published or used to sign the zone, regardless of any other metadata. -.RE +If either of the key\*(Aqs unpublication or deletion dates are set and in the past, the key is NOT published or used to sign the zone, regardless of any other metadata\&. .RE .RE .PP \-T \fIttl\fR .RS 4 -Specifies a TTL to be used for new DNSKEY records imported into the zone from the key repository. If not specified, the default is the TTL value from the zone's SOA record. This option is ignored when signing without -\fB\-S\fR, since DNSKEY records are not imported from the key repository in that case. It is also ignored if there are any pre\-existing DNSKEY records at the zone apex, in which case new records' TTL values will be set to match them, or if any of the imported DNSKEY records had a default TTL value. In the event of a a conflict between TTL values in imported keys, the shortest one is used. +Specifies a TTL to be used for new DNSKEY records imported into the zone from the key repository\&. If not specified, the default is the TTL value from the zone\*(Aqs SOA record\&. This option is ignored when signing without +\fB\-S\fR, since DNSKEY records are not imported from the key repository in that case\&. It is also ignored if there are any pre\-existing DNSKEY records at the zone apex, in which case new records\*(Aq TTL values will be set to match them, or if any of the imported DNSKEY records had a default TTL value\&. In the event of a a conflict between TTL values in imported keys, the shortest one is used\&. .RE .PP \-t .RS 4 -Print statistics at completion. +Print statistics at completion\&. .RE .PP \-u .RS 4 -Update NSEC/NSEC3 chain when re\-signing a previously signed zone. With this option, a zone signed with NSEC can be switched to NSEC3, or a zone signed with NSEC3 can be switch to NSEC or to NSEC3 with different parameters. Without this option, +Update NSEC/NSEC3 chain when re\-signing a previously signed zone\&. With this option, a zone signed with NSEC can be switched to NSEC3, or a zone signed with NSEC3 can be switch to NSEC or to NSEC3 with different parameters\&. Without this option, \fBdnssec\-signzone\fR -will retain the existing chain when re\-signing. +will retain the existing chain when re\-signing\&. .RE .PP \-v \fIlevel\fR .RS 4 -Sets the debugging level. +Sets the debugging level\&. .RE .PP \-x .RS 4 -Only sign the DNSKEY RRset with key\-signing keys, and omit signatures from zone\-signing keys. (This is similar to the +Only sign the DNSKEY RRset with key\-signing keys, and omit signatures from zone\-signing keys\&. (This is similar to the \fBdnssec\-dnskey\-kskonly yes;\fR zone option in -\fBnamed\fR.) +\fBnamed\fR\&.) .RE .PP \-z .RS 4 -Ignore KSK flag on key when determining what to sign. This causes KSK\-flagged keys to sign all records, not just the DNSKEY RRset. (This is similar to the +Ignore KSK flag on key when determining what to sign\&. This causes KSK\-flagged keys to sign all records, not just the DNSKEY RRset\&. (This is similar to the \fBupdate\-check\-ksk no;\fR zone option in -\fBnamed\fR.) +\fBnamed\fR\&.) .RE .PP \-3 \fIsalt\fR .RS 4 -Generate an NSEC3 chain with the given hex encoded salt. A dash (\fIsalt\fR) can be used to indicate that no salt is to be used when generating the NSEC3 chain. +Generate an NSEC3 chain with the given hex encoded salt\&. A dash (\fIsalt\fR) can be used to indicate that no salt is to be used when generating the NSEC3 chain\&. .RE .PP \-H \fIiterations\fR .RS 4 -When generating an NSEC3 chain, use this many iterations. The default is 10. +When generating an NSEC3 chain, use this many iterations\&. The default is 10\&. .RE .PP \-A .RS 4 -When generating an NSEC3 chain set the OPTOUT flag on all NSEC3 records and do not generate NSEC3 records for insecure delegations. +When generating an NSEC3 chain set the OPTOUT flag on all NSEC3 records and do not generate NSEC3 records for insecure delegations\&. .sp -Using this option twice (i.e., -\fB\-AA\fR) turns the OPTOUT flag off for all records. This is useful when using the +Using this option twice (i\&.e\&., +\fB\-AA\fR) turns the OPTOUT flag off for all records\&. This is useful when using the \fB\-u\fR -option to modify an NSEC3 chain which previously had OPTOUT set. +option to modify an NSEC3 chain which previously had OPTOUT set\&. .RE .PP zonefile .RS 4 -The file containing the zone to be signed. +The file containing the zone to be signed\&. .RE .PP key .RS 4 -Specify which keys should be used to sign the zone. If no keys are specified, then the zone will be examined for DNSKEY records at the zone apex. If these are found and there are matching private keys, in the current directory, then these will be used for signing. +Specify which keys should be used to sign the zone\&. If no keys are specified, then the zone will be examined for DNSKEY records at the zone apex\&. If these are found and there are matching private keys, in the current directory, then these will be used for signing\&. .RE .SH "EXAMPLE" .PP The following command signs the -\fBexample.com\fR +\fBexample\&.com\fR zone with the DSA key generated by \fBdnssec\-keygen\fR -(Kexample.com.+003+17247). Because the +(Kexample\&.com\&.+003+17247)\&. Because the \fB\-S\fR -option is not being used, the zone's keys must be in the master file (\fIdb.example.com\fR). This invocation looks for -\fIdsset\fR -files, in the current directory, so that DS records can be imported from them (\fB\-g\fR). +option is not being used, the zone\*(Aqs keys must be in the master file (db\&.example\&.com)\&. This invocation looks for +dsset +files, in the current directory, so that DS records can be imported from them (\fB\-g\fR)\&. .sp +.if n \{\ .RS 4 +.\} .nf -% dnssec\-signzone \-g \-o example.com db.example.com \\ -Kexample.com.+003+17247 -db.example.com.signed +% dnssec\-signzone \-g \-o example\&.com db\&.example\&.com \e +Kexample\&.com\&.+003+17247 +db\&.example\&.com\&.signed % .fi +.if n \{\ .RE +.\} .PP In the above example, \fBdnssec\-signzone\fR creates the file -\fIdb.example.com.signed\fR. This file should be referenced in a zone statement in a -\fInamed.conf\fR -file. +db\&.example\&.com\&.signed\&. This file should be referenced in a zone statement in a +named\&.conf +file\&. .PP -This example re\-signs a previously signed zone with default parameters. The private keys are assumed to be in the current directory. +This example re\-signs a previously signed zone with default parameters\&. The private keys are assumed to be in the current directory\&. .sp +.if n \{\ .RS 4 +.\} .nf -% cp db.example.com.signed db.example.com -% dnssec\-signzone \-o example.com db.example.com -db.example.com.signed +% cp db\&.example\&.com\&.signed db\&.example\&.com +% dnssec\-signzone \-o example\&.com db\&.example\&.com +db\&.example\&.com\&.signed % .fi +.if n \{\ .RE +.\} .SH "SEE ALSO" .PP -\fBdnssec\-keygen\fR(8), +\fBdnssec-keygen\fR(8), BIND 9 Administrator Reference Manual, RFC 4033, -RFC 4641. +RFC 4641\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004\-2009, 2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") .br -Copyright \(co 2000\-2003 Internet Software Consortium. +Copyright \(co 2004-2009, 2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2000-2003 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.c b/contrib/bind9/bin/dnssec/dnssec-signzone.c index 6ef8e44b9..6e85fe110 100644 --- a/contrib/bind9/bin/dnssec/dnssec-signzone.c +++ b/contrib/bind9/bin/dnssec/dnssec-signzone.c @@ -1,5 +1,5 @@ /* - * Portions Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") + * Portions Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") * Portions Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -1099,6 +1099,10 @@ signname(dns_dbnode_t *node, dns_name_t *name) { dns_diff_clear(&add); } +/* + * See if the node contains any non RRSIG/NSEC records and report to + * caller. Clean out extranous RRSIG records for node. + */ static inline isc_boolean_t active_node(dns_dbnode_t *node) { dns_rdatasetiter_t *rdsiter = NULL; @@ -1771,9 +1775,12 @@ nsecify(void) { continue; } - if (dns_name_equal(name, gorigin)) + if (dns_name_equal(name, gorigin)) { remove_records(node, dns_rdatatype_nsec3param, ISC_TRUE); + /* Clean old rrsigs at apex. */ + (void)active_node(node); + } if (is_delegation(gdb, gversion, gorigin, name, node, &nsttl)) { zonecut = dns_fixedname_name(&fzonecut); @@ -2189,8 +2196,11 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations, continue; } - if (dns_name_equal(name, gorigin)) + if (dns_name_equal(name, gorigin)) { remove_records(node, dns_rdatatype_nsec, ISC_TRUE); + /* Clean old rrsigs at apex. */ + (void)active_node(node); + } result = dns_dbiterator_next(dbiter); nextnode = NULL; diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.docbook b/contrib/bind9/bin/dnssec/dnssec-signzone.docbook index 4a092112c..75e9b2d51 100644 --- a/contrib/bind9/bin/dnssec/dnssec-signzone.docbook +++ b/contrib/bind9/bin/dnssec/dnssec-signzone.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2013-12-11 + - December 11, 2013 + ISC + Internet Systems Consortium, Inc. @@ -45,6 +47,7 @@ 2011 2013 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -57,51 +60,51 @@ - + dnssec-signzone - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - zonefile - key + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + zonefile + key - - DESCRIPTION + DESCRIPTION + dnssec-signzone signs a zone. It generates NSEC and RRSIG records and produces a signed version of the @@ -110,10 +113,10 @@ determined by the presence or absence of a keyset file for each child zone. - + + + OPTIONS - - OPTIONS @@ -387,7 +390,7 @@ -L serial - When writing a signed zone to 'raw' format, set the "source serial" + When writing a signed zone to 'raw' format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.) @@ -508,7 +511,7 @@ Normally, when a previously-signed zone is passed as input to the signer, and a DNSKEY record has been removed and - replaced with a new one, signatures from the old key + replaced with a new one, signatures from the old key that are still within their validity period are retained. This allows the zone to continue to validate with cached copies of the old DNSKEY RRset. The @@ -589,7 +592,7 @@ If the key's activation date is set and in the past, the key is published (regardless of publication date) and - used to sign the zone. + used to sign the zone. @@ -754,10 +757,10 @@ - + + + EXAMPLE - - EXAMPLE The following command signs the example.com zone with the DSA key generated by dnssec-keygen @@ -785,26 +788,16 @@ db.example.com.signed % dnssec-signzone -o example.com db.example.com db.example.com.signed % - + + + SEE ALSO - - SEE ALSO dnssec-keygen8 , BIND 9 Administrator Reference Manual, RFC 4033, RFC 4641. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/dnssec/dnssec-signzone.html b/contrib/bind9/bin/dnssec/dnssec-signzone.html index 399550720..fec6c8f76 100644 --- a/contrib/bind9/bin/dnssec/dnssec-signzone.html +++ b/contrib/bind9/bin/dnssec/dnssec-signzone.html @@ -1,5 +1,5 @@ - dnssec-signzone - + -
    +

    Name

    @@ -31,9 +30,9 @@

    Synopsis

    dnssec-signzone [-a] [-c class] [-d directory] [-D] [-E engine] [-e end-time] [-f output-file] [-g] [-h] [-K directory] [-k key] [-L serial] [-l domain] [-i interval] [-I input-format] [-j jitter] [-N soa-serial-format] [-o origin] [-O output-format] [-P] [-p] [-R] [-r randomdev] [-S] [-s start-time] [-T ttl] [-t] [-u] [-v level] [-V] [-X extended end-time] [-x] [-z] [-3 salt] [-H iterations] [-A] {zonefile} [key...]

    -
    -

    DESCRIPTION

    -

    dnssec-signzone +

    +

    DESCRIPTION

    +

    dnssec-signzone signs a zone. It generates NSEC and RRSIG records and produces a signed version of the zone. The security status of delegations from the signed zone @@ -42,9 +41,9 @@ keyset file for each child zone.

    -
    -

    OPTIONS

    -
    +
    +

    OPTIONS

    +
    -a

    Verify all generated signatures. @@ -60,7 +59,7 @@ file in addition to dsset-zonename when signing a zone, for use by older versions of - dnssec-signzone. + dnssec-signzone.

    -d directory

    @@ -70,11 +69,11 @@

    -D

    Output only those record types automatically managed by - dnssec-signzone, i.e. RRSIG, NSEC, + dnssec-signzone, i.e. RRSIG, NSEC, NSEC3 and NSEC3PARAM records. If smart signing (-S) is used, DNSKEY records are also included. The resulting file can be included in the original - zone file with $INCLUDE. This option + zone file with $INCLUDE. This option cannot be combined with -O raw or serial number updating.

    @@ -163,7 +162,7 @@
    -h

    Prints a short summary of the options and arguments to - dnssec-signzone. + dnssec-signzone.

    -V

    @@ -183,7 +182,7 @@ The default cycle interval is one quarter of the difference between the signature end and start times. So if neither end-time or start-time - are specified, dnssec-signzone + are specified, dnssec-signzone generates signatures that are valid for 30 days, with a cycle interval of 7.5 days. Therefore, if any existing RRSIG records @@ -194,8 +193,8 @@

    -I input-format

    The format of the input zone file. - Possible formats are "text" (default) - and "raw". + Possible formats are "text" (default) + and "raw". This option is primarily intended to be used for dynamic signed zones so that the dumped zone file in a non-text format containing updates can be signed directly. @@ -225,7 +224,7 @@

    -L serial

    - When writing a signed zone to 'raw' format, set the "source serial" + When writing a signed zone to 'raw' format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.)

    @@ -238,17 +237,17 @@

    The SOA serial number format of the signed zone. - Possible formats are "keep" (default), - "increment" and - "unixtime". + Possible formats are "keep" (default), + "increment" and + "unixtime".

    -
    -
    "keep"
    +
    +
    "keep"

    Do not modify the SOA serial number.

    -
    "increment"
    +
    "increment"

    Increment the SOA serial number using RFC 1982 arithmetics.

    -
    "unixtime"
    +
    "unixtime"

    Set the SOA serial number to the number of seconds since epoch.

    @@ -261,15 +260,15 @@
    -O output-format

    The format of the output file containing the signed zone. - Possible formats are "text" (default) - "full", which is text output in a + Possible formats are "text" (default) + "full", which is text output in a format suitable for processing by external scripts, - and "raw" or "raw=N", + and "raw" or "raw=N", which store the zone in a binary format for rapid loading - by named. "raw=N" + by named. "raw=N" specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of - named; if N is 1, the file can be + named; if N is 1, the file can be read by release 9.9.0 or higher. The default is 1.

    -p
    @@ -300,11 +299,11 @@

    Normally, when a previously-signed zone is passed as input to the signer, and a DNSKEY record has been removed and - replaced with a new one, signatures from the old key + replaced with a new one, signatures from the old key that are still within their validity period are retained. This allows the zone to continue to validate with cached copies of the old DNSKEY RRset. The -Q - forces dnssec-signzone to remove + forces dnssec-signzone to remove signatures from keys that are no longer active. This enables ZSK rollover using the procedure described in RFC 4641, section 4.2.1.1 ("Pre-Publish Key Rollover"). @@ -317,7 +316,7 @@

    This option is similar to -Q, except it - forces dnssec-signzone to signatures from + forces dnssec-signzone to signatures from keys that are no longer published. This enables ZSK rollover using the procedure described in RFC 4641, section 4.2.1.2 ("Double Signature Zone Signing Key Rollover"). @@ -338,7 +337,7 @@

    -S

    - Smart signing: Instructs dnssec-signzone to + Smart signing: Instructs dnssec-signzone to search the key repository for keys that match the zone being signed, and to include them in the zone if appropriate.

    @@ -348,7 +347,7 @@ rules. Each successive rule takes priority over the prior ones:

    -
    +

    If no timing metadata has been set for the key, the key is @@ -363,7 +362,7 @@

    If the key's activation date is set and in the past, the key is published (regardless of publication date) and - used to sign the zone. + used to sign the zone.

    @@ -403,7 +402,7 @@ zone. With this option, a zone signed with NSEC can be switched to NSEC3, or a zone signed with NSEC3 can be switch to NSEC or to NSEC3 with different parameters. - Without this option, dnssec-signzone will + Without this option, dnssec-signzone will retain the existing chain when re-signing.

    -v level
    @@ -414,16 +413,16 @@

    Only sign the DNSKEY RRset with key-signing keys, and omit signatures from zone-signing keys. (This is similar to the - dnssec-dnskey-kskonly yes; zone option in - named.) + dnssec-dnskey-kskonly yes; zone option in + named.)

    -z

    Ignore KSK flag on key when determining what to sign. This causes KSK-flagged keys to sign all records, not just the DNSKEY RRset. (This is similar to the - update-check-ksk no; zone option in - named.) + update-check-ksk no; zone option in + named.)

    -3 salt

    @@ -464,23 +463,23 @@

    -
    -

    EXAMPLE

    +
    +

    EXAMPLE

    The following command signs the example.com - zone with the DSA key generated by dnssec-keygen - (Kexample.com.+003+17247). Because the -S option + zone with the DSA key generated by dnssec-keygen + (Kexample.com.+003+17247). Because the -S option is not being used, the zone's keys must be in the master file (db.example.com). This invocation looks for dsset files, in the current directory, - so that DS records can be imported from them (-g). + so that DS records can be imported from them (-g). 

    % dnssec-signzone -g -o example.com db.example.com \
 Kexample.com.+003+17247
 db.example.com.signed
 %

    - In the above example, dnssec-signzone creates + In the above example, dnssec-signzone creates the file db.example.com.signed. This file should be referenced in a zone statement in a named.conf file. @@ -494,17 +493,12 @@ db.example.com.signed db.example.com.signed %

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    dnssec-keygen(8), BIND 9 Administrator Reference Manual, RFC 4033, RFC 4641.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/dnssec/dnssec-verify.8 b/contrib/bind9/bin/dnssec/dnssec-verify.8 index df4278333..6add24745 100644 --- a/contrib/bind9/bin/dnssec/dnssec-verify.8 +++ b/contrib/bind9/bin/dnssec/dnssec-verify.8 @@ -1,102 +1,118 @@ -.\" Copyright (C) 2012, 2014 Internet Systems Consortium, Inc. ("ISC") -.\" +.\" Copyright (C) 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") +.\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above .\" copyright notice and this permission notice appear in all copies. -.\" +.\" .\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH .\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, .\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM .\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: dnssec\-verify +'\" t +.\" Title: dnssec-verify .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 26, 2012 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2012-06-26 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "DNSSEC\-VERIFY" "8" "June 26, 2012" "BIND9" "BIND9" +.TH "DNSSEC\-VERIFY" "8" "2012\-06\-26" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -dnssec\-verify \- DNSSEC zone verification tool +dnssec-verify \- DNSSEC zone verification tool .SH "SYNOPSIS" -.HP 14 +.HP \w'\fBdnssec\-verify\fR\ 'u \fBdnssec\-verify\fR [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-x\fR] [\fB\-z\fR] {zonefile} .SH "DESCRIPTION" .PP \fBdnssec\-verify\fR -verifies that a zone is fully signed for each algorithm found in the DNSKEY RRset for the zone, and that the NSEC / NSEC3 chains are complete. +verifies that a zone is fully signed for each algorithm found in the DNSKEY RRset for the zone, and that the NSEC / NSEC3 chains are complete\&. .SH "OPTIONS" .PP \-c \fIclass\fR .RS 4 -Specifies the DNS class of the zone. +Specifies the DNS class of the zone\&. .RE .PP \-I \fIinput\-format\fR .RS 4 -The format of the input zone file. Possible formats are +The format of the input zone file\&. Possible formats are \fB"text"\fR (default) and -\fB"raw"\fR. This option is primarily intended to be used for dynamic signed zones so that the dumped zone file in a non\-text format containing updates can be verified independently. The use of this option does not make much sense for non\-dynamic zones. +\fB"raw"\fR\&. This option is primarily intended to be used for dynamic signed zones so that the dumped zone file in a non\-text format containing updates can be verified independently\&. The use of this option does not make much sense for non\-dynamic zones\&. .RE .PP \-o \fIorigin\fR .RS 4 -The zone origin. If not specified, the name of the zone file is assumed to be the origin. +The zone origin\&. If not specified, the name of the zone file is assumed to be the origin\&. .RE .PP \-v \fIlevel\fR .RS 4 -Sets the debugging level. +Sets the debugging level\&. .RE .PP \-V .RS 4 -Prints version information. +Prints version information\&. .RE .PP \-x .RS 4 -Only verify that the DNSKEY RRset is signed with key\-signing keys. Without this flag, it is assumed that the DNSKEY RRset will be signed by all active keys. When this flag is set, it will not be an error if the DNSKEY RRset is not signed by zone\-signing keys. This corresponds to the +Only verify that the DNSKEY RRset is signed with key\-signing keys\&. Without this flag, it is assumed that the DNSKEY RRset will be signed by all active keys\&. When this flag is set, it will not be an error if the DNSKEY RRset is not signed by zone\-signing keys\&. This corresponds to the \fB\-x\fR option in -\fBdnssec\-signzone\fR. +\fBdnssec\-signzone\fR\&. .RE .PP \-z .RS 4 -Ignore the KSK flag on the keys when determining whether the zone if correctly signed. Without this flag it is assumed that there will be a non\-revoked, self\-signed DNSKEY with the KSK flag set for each algorithm and that RRsets other than DNSKEY RRset will be signed with a different DNSKEY without the KSK flag set. +Ignore the KSK flag on the keys when determining whether the zone if correctly signed\&. Without this flag it is assumed that there will be a non\-revoked, self\-signed DNSKEY with the KSK flag set for each algorithm and that RRsets other than DNSKEY RRset will be signed with a different DNSKEY without the KSK flag set\&. .sp -With this flag set, we only require that for each algorithm, there will be at least one non\-revoked, self\-signed DNSKEY, regardless of the KSK flag state, and that other RRsets will be signed by a non\-revoked key for the same algorithm that includes the self\-signed key; the same key may be used for both purposes. This corresponds to the +With this flag set, we only require that for each algorithm, there will be at least one non\-revoked, self\-signed DNSKEY, regardless of the KSK flag state, and that other RRsets will be signed by a non\-revoked key for the same algorithm that includes the self\-signed key; the same key may be used for both purposes\&. This corresponds to the \fB\-z\fR option in -\fBdnssec\-signzone\fR. +\fBdnssec\-signzone\fR\&. .RE .PP zonefile .RS 4 -The file containing the zone to be signed. +The file containing the zone to be signed\&. .RE .SH "SEE ALSO" .PP -\fBdnssec\-signzone\fR(8), +\fBdnssec-signzone\fR(8), BIND 9 Administrator Reference Manual, -RFC 4033. +RFC 4033\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2012, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/dnssec/dnssec-verify.docbook b/contrib/bind9/bin/dnssec/dnssec-verify.docbook index d3c47c9c1..22f88998d 100644 --- a/contrib/bind9/bin/dnssec/dnssec-verify.docbook +++ b/contrib/bind9/bin/dnssec/dnssec-verify.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2012-06-26 + - June 26, 2012 + ISC + Internet Systems Consortium, Inc. @@ -37,36 +39,37 @@ 2012 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") - + dnssec-verify - - - - - - - - - zonefile + + + + + + + + + zonefile - - DESCRIPTION + DESCRIPTION + dnssec-verify verifies that a zone is fully signed for each algorithm found in the DNSKEY RRset for the zone, and that the NSEC / NSEC3 chains are complete. - + + + OPTIONS - - OPTIONS @@ -169,10 +172,10 @@ - + + + SEE ALSO - - SEE ALSO dnssec-signzone8 @@ -180,16 +183,6 @@ BIND 9 Administrator Reference Manual, RFC 4033. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/dnssec/dnssec-verify.html b/contrib/bind9/bin/dnssec/dnssec-verify.html index 8e2376689..b973634e0 100644 --- a/contrib/bind9/bin/dnssec/dnssec-verify.html +++ b/contrib/bind9/bin/dnssec/dnssec-verify.html @@ -1,5 +1,5 @@ - dnssec-verify - + -
    +

    Name

    @@ -30,17 +29,17 @@

    Synopsis

    dnssec-verify [-c class] [-E engine] [-I input-format] [-o origin] [-v level] [-V] [-x] [-z] {zonefile}

    -
    -

    DESCRIPTION

    -

    dnssec-verify +

    +

    DESCRIPTION

    +

    dnssec-verify verifies that a zone is fully signed for each algorithm found in the DNSKEY RRset for the zone, and that the NSEC / NSEC3 chains are complete.

    -
    -

    OPTIONS

    -
    +
    +

    OPTIONS

    +
    -c class

    Specifies the DNS class of the zone. @@ -48,8 +47,8 @@

    -I input-format

    The format of the input zone file. - Possible formats are "text" (default) - and "raw". + Possible formats are "text" (default) + and "raw". This option is primarily intended to be used for dynamic signed zones so that the dumped zone file in a non-text format containing updates can be verified independently. @@ -76,7 +75,7 @@ will be signed by all active keys. When this flag is set, it will not be an error if the DNSKEY RRset is not signed by zone-signing keys. This corresponds to the -x - option in dnssec-signzone. + option in dnssec-signzone.

    -z
    @@ -95,7 +94,7 @@ will be signed by a non-revoked key for the same algorithm that includes the self-signed key; the same key may be used for both purposes. This corresponds to the -z - option in dnssec-signzone. + option in dnssec-signzone.

    zonefile
    @@ -104,18 +103,13 @@

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 4033.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/named/Makefile.in b/contrib/bind9/bin/named/Makefile.in index 1d4a365d5..3af6d83b8 100644 --- a/contrib/bind9/bin/named/Makefile.in +++ b/contrib/bind9/bin/named/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2002 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @BIND9_PRODUCT@ diff --git a/contrib/bind9/bin/named/client.c b/contrib/bind9/bin/named/client.c index de2d596c8..9ad78be84 100644 --- a/contrib/bind9/bin/named/client.c +++ b/contrib/bind9/bin/named/client.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -953,6 +953,12 @@ ns_client_send(ns_client_t *client) { else if (client->view->preferred_glue == dns_rdatatype_aaaa) preferred_glue = DNS_MESSAGERENDER_PREFER_AAAA; } + if (preferred_glue == 0) { + if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) + preferred_glue = DNS_MESSAGERENDER_PREFER_A; + else + preferred_glue = DNS_MESSAGERENDER_PREFER_AAAA; + } #ifdef ALLOW_FILTER_AAAA_ON_V4 /* @@ -1194,7 +1200,7 @@ ns_client_error(ns_client_t *client, isc_result_t result) { */ if (wouldlog) { ns_client_log(client, - NS_LOGCATEGORY_QUERY_EERRORS, + NS_LOGCATEGORY_QUERY_ERRORS, NS_LOGMODULE_CLIENT, loglevel, "%s", log_buf); @@ -1666,7 +1672,7 @@ client_request(isc_task_t *task, isc_event_t *event) { (void)client_addopt(client); ns_client_log(client, NS_LOGCATEGORY_CLIENT, - NS_LOGMODULE_CLIENT, ISC_LOG_WARNING, + NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1), "message parsing failed: %s", isc_result_totext(result)); ns_client_error(client, result); diff --git a/contrib/bind9/bin/named/config.c b/contrib/bind9/bin/named/config.c index cab6f1fd0..4798272ac 100644 --- a/contrib/bind9/bin/named/config.c +++ b/contrib/bind9/bin/named/config.c @@ -103,9 +103,9 @@ options {\n\ transfers-per-ns 2;\n\ transfers-in 10;\n\ transfers-out 10;\n\ - treat-cr-as-space true;\n\ - use-id-pool true;\n\ - use-ixfr true;\n\ +# treat-cr-as-space ;\n\ +# use-id-pool ;\n\ +# use-ixfr ;\n\ edns-udp-size 4096;\n\ max-udp-size 4096;\n\ request-nsid false;\n\ diff --git a/contrib/bind9/bin/named/control.c b/contrib/bind9/bin/named/control.c index 37e3a3843..b1b744f2c 100644 --- a/contrib/bind9/bin/named/control.c +++ b/contrib/bind9/bin/named/control.c @@ -24,6 +24,7 @@ #include #include +#include #include #include #include @@ -36,6 +37,7 @@ #include #include +#include #include #include #include @@ -43,15 +45,30 @@ #include #endif -static isc_boolean_t -command_compare(const char *text, const char *command) { - unsigned int commandlen = strlen(command); - if (strncasecmp(text, command, commandlen) == 0 && - (text[commandlen] == '\0' || - text[commandlen] == ' ' || - text[commandlen] == '\t')) - return (ISC_TRUE); - return (ISC_FALSE); +static isc_result_t +getcommand(isc_lex_t *lex, char **cmdp) { + isc_result_t result; + isc_token_t token; + + REQUIRE(cmdp != NULL && *cmdp == NULL); + + result = isc_lex_gettoken(lex, ISC_LEXOPT_EOF, &token); + if (result != ISC_R_SUCCESS) + return (result); + + isc_lex_ungettoken(lex, &token); + + if (token.type != isc_tokentype_string) + return (ISC_R_FAILURE); + + *cmdp = token.value.as_textregion.base; + + return (ISC_R_SUCCESS); +} + +static inline isc_boolean_t +command_compare(const char *str, const char *command) { + return ISC_TF(strcasecmp(str, command) == 0); } /*% @@ -61,9 +78,12 @@ command_compare(const char *text, const char *command) { isc_result_t ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { isccc_sexpr_t *data; + char *cmdline = NULL; char *command = NULL; isc_result_t result; int log_level; + isc_buffer_t src; + isc_lex_t *lex = NULL; #ifdef HAVE_LIBSCF ns_smf_want_disable = 0; #endif @@ -76,7 +96,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { return (ISC_R_FAILURE); } - result = isccc_cc_lookupstring(data, "type", &command); + result = isccc_cc_lookupstring(data, "type", &cmdline); if (result != ISC_R_SUCCESS) { /* * We have no idea what this is. @@ -84,6 +104,20 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { return (result); } + result = isc_lex_create(ns_g_mctx, strlen(cmdline), &lex); + if (result != ISC_R_SUCCESS) + return (result); + + isc_buffer_init(&src, cmdline, strlen(cmdline)); + isc_buffer_add(&src, strlen(cmdline)); + result = isc_lex_openbuffer(lex, &src); + if (result != ISC_R_SUCCESS) + goto cleanup; + + result = getcommand(lex, &command); + if (result != ISC_R_SUCCESS) + goto cleanup; + /* * Compare the 'command' parameter against all known control commands. */ @@ -93,20 +127,21 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { } else { log_level = ISC_LOG_INFO; } + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_CONTROL, log_level, "received control channel command '%s'", command); if (command_compare(command, NS_COMMAND_RELOAD)) { - result = ns_server_reloadcommand(ns_g_server, command, text); + result = ns_server_reloadcommand(ns_g_server, lex, text); } else if (command_compare(command, NS_COMMAND_RECONFIG)) { result = ns_server_reconfigcommand(ns_g_server); } else if (command_compare(command, NS_COMMAND_REFRESH)) { - result = ns_server_refreshcommand(ns_g_server, command, text); + result = ns_server_refreshcommand(ns_g_server, lex, text); } else if (command_compare(command, NS_COMMAND_RETRANSFER)) { result = ns_server_retransfercommand(ns_g_server, - command, text); + lex, text); } else if (command_compare(command, NS_COMMAND_HALT)) { #ifdef HAVE_LIBSCF /* @@ -116,7 +151,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { */ if (ns_smf_got_instance == 1 && ns_smf_chroot == 1) { result = ns_smf_add_message(text); - return (result); + goto cleanup; } /* * If we are managed by smf(5) but not in chroot, @@ -132,7 +167,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { #endif /* Do not flush master files */ ns_server_flushonshutdown(ns_g_server, ISC_FALSE); - ns_os_shutdownmsg(command, text); + ns_os_shutdownmsg(cmdline, text); isc_app_shutdown(); result = ISC_R_SUCCESS; } else if (command_compare(command, NS_COMMAND_STOP)) { @@ -143,51 +178,51 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { #ifdef HAVE_LIBSCF if (ns_smf_got_instance == 1 && ns_smf_chroot == 1) { result = ns_smf_add_message(text); - return (result); + goto cleanup; } if (ns_smf_got_instance == 1 && ns_smf_chroot == 0) ns_smf_want_disable = 1; #endif ns_server_flushonshutdown(ns_g_server, ISC_TRUE); - ns_os_shutdownmsg(command, text); + ns_os_shutdownmsg(cmdline, text); isc_app_shutdown(); result = ISC_R_SUCCESS; } else if (command_compare(command, NS_COMMAND_DUMPSTATS)) { result = ns_server_dumpstats(ns_g_server); } else if (command_compare(command, NS_COMMAND_QUERYLOG)) { - result = ns_server_togglequerylog(ns_g_server, command); + result = ns_server_togglequerylog(ns_g_server, lex); } else if (command_compare(command, NS_COMMAND_DUMPDB)) { - ns_server_dumpdb(ns_g_server, command); + ns_server_dumpdb(ns_g_server, lex); result = ISC_R_SUCCESS; } else if (command_compare(command, NS_COMMAND_SECROOTS)) { - result = ns_server_dumpsecroots(ns_g_server, command); + result = ns_server_dumpsecroots(ns_g_server, lex); } else if (command_compare(command, NS_COMMAND_TRACE)) { - result = ns_server_setdebuglevel(ns_g_server, command); + result = ns_server_setdebuglevel(ns_g_server, lex); } else if (command_compare(command, NS_COMMAND_NOTRACE)) { ns_g_debuglevel = 0; isc_log_setdebuglevel(ns_g_lctx, ns_g_debuglevel); result = ISC_R_SUCCESS; } else if (command_compare(command, NS_COMMAND_FLUSH)) { - result = ns_server_flushcache(ns_g_server, command); + result = ns_server_flushcache(ns_g_server, lex); } else if (command_compare(command, NS_COMMAND_FLUSHNAME)) { - result = ns_server_flushnode(ns_g_server, command, ISC_FALSE); + result = ns_server_flushnode(ns_g_server, lex, ISC_FALSE); } else if (command_compare(command, NS_COMMAND_FLUSHTREE)) { - result = ns_server_flushnode(ns_g_server, command, ISC_TRUE); + result = ns_server_flushnode(ns_g_server, lex, ISC_TRUE); } else if (command_compare(command, NS_COMMAND_STATUS)) { result = ns_server_status(ns_g_server, text); } else if (command_compare(command, NS_COMMAND_TSIGLIST)) { result = ns_server_tsiglist(ns_g_server, text); } else if (command_compare(command, NS_COMMAND_TSIGDELETE)) { - result = ns_server_tsigdelete(ns_g_server, command, text); + result = ns_server_tsigdelete(ns_g_server, lex, text); } else if (command_compare(command, NS_COMMAND_FREEZE)) { - result = ns_server_freeze(ns_g_server, ISC_TRUE, command, + result = ns_server_freeze(ns_g_server, ISC_TRUE, lex, text); } else if (command_compare(command, NS_COMMAND_UNFREEZE) || command_compare(command, NS_COMMAND_THAW)) { - result = ns_server_freeze(ns_g_server, ISC_FALSE, command, + result = ns_server_freeze(ns_g_server, ISC_FALSE, lex, text); } else if (command_compare(command, NS_COMMAND_SYNC)) { - result = ns_server_sync(ns_g_server, command, text); + result = ns_server_sync(ns_g_server, lex, text); } else if (command_compare(command, NS_COMMAND_RECURSING)) { result = ns_server_dumprecursing(ns_g_server); } else if (command_compare(command, NS_COMMAND_TIMERPOKE)) { @@ -196,18 +231,18 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { } else if (command_compare(command, NS_COMMAND_NULL)) { result = ISC_R_SUCCESS; } else if (command_compare(command, NS_COMMAND_NOTIFY)) { - result = ns_server_notifycommand(ns_g_server, command, text); + result = ns_server_notifycommand(ns_g_server, lex, text); } else if (command_compare(command, NS_COMMAND_VALIDATION)) { - result = ns_server_validation(ns_g_server, command); + result = ns_server_validation(ns_g_server, lex); } else if (command_compare(command, NS_COMMAND_SIGN) || command_compare(command, NS_COMMAND_LOADKEYS)) { - result = ns_server_rekey(ns_g_server, command, text); + result = ns_server_rekey(ns_g_server, lex, text); } else if (command_compare(command, NS_COMMAND_ADDZONE)) { - result = ns_server_add_zone(ns_g_server, command, text); + result = ns_server_add_zone(ns_g_server, cmdline, text); } else if (command_compare(command, NS_COMMAND_DELZONE)) { - result = ns_server_del_zone(ns_g_server, command, text); + result = ns_server_del_zone(ns_g_server, lex, text); } else if (command_compare(command, NS_COMMAND_SIGNING)) { - result = ns_server_signing(ns_g_server, command, text); + result = ns_server_signing(ns_g_server, lex, text); } else { isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_CONTROL, ISC_LOG_WARNING, @@ -216,5 +251,9 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) { result = DNS_R_UNKNOWNCOMMAND; } + cleanup: + if (lex != NULL) + isc_lex_destroy(&lex); + return (result); } diff --git a/contrib/bind9/bin/named/controlconf.c b/contrib/bind9/bin/named/controlconf.c index ddb7000ca..afe4a801f 100644 --- a/contrib/bind9/bin/named/controlconf.c +++ b/contrib/bind9/bin/named/controlconf.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2008, 2011-2014, 2016 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2008, 2011-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -539,6 +539,10 @@ newconnection(controllistener_t *listener, isc_socket_t *sock) { conn->sock = sock; isccc_ccmsg_init(listener->mctx, sock, &conn->ccmsg); + + /* Set a 32 KiB upper limit on incoming message. */ + isccc_ccmsg_setmaxsize(&conn->ccmsg, 32768); + conn->ccmsg_valid = ISC_TRUE; conn->sending = ISC_FALSE; conn->timer = NULL; diff --git a/contrib/bind9/bin/named/include/named/log.h b/contrib/bind9/bin/named/include/named/log.h index 032743acb..adc9ae289 100644 --- a/contrib/bind9/bin/named/include/named/log.h +++ b/contrib/bind9/bin/named/include/named/log.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -36,7 +36,7 @@ #define NS_LOGCATEGORY_QUERIES (&ns_g_categories[4]) #define NS_LOGCATEGORY_UNMATCHED (&ns_g_categories[5]) #define NS_LOGCATEGORY_UPDATE_SECURITY (&ns_g_categories[6]) -#define NS_LOGCATEGORY_QUERY_EERRORS (&ns_g_categories[7]) +#define NS_LOGCATEGORY_QUERY_ERRORS (&ns_g_categories[7]) /* * Backwards compatibility. diff --git a/contrib/bind9/bin/named/include/named/query.h b/contrib/bind9/bin/named/include/named/query.h index 444729a98..312602dc8 100644 --- a/contrib/bind9/bin/named/include/named/query.h +++ b/contrib/bind9/bin/named/include/named/query.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2010, 2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2010, 2011, 2013, 2014, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -46,6 +46,7 @@ struct ns_query { isc_boolean_t timerset; dns_name_t * qname; dns_name_t * origqname; + dns_rdatatype_t qtype; unsigned int dboptions; unsigned int fetchoptions; dns_db_t * gluedb; diff --git a/contrib/bind9/bin/named/include/named/server.h b/contrib/bind9/bin/named/include/named/server.h index a3696f161..3cb4674a9 100644 --- a/contrib/bind9/bin/named/include/named/server.h +++ b/contrib/bind9/bin/named/include/named/server.h @@ -15,8 +15,6 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ - #ifndef NAMED_SERVER_H #define NAMED_SERVER_H 1 @@ -223,7 +221,8 @@ ns_server_flushonshutdown(ns_server_t *server, isc_boolean_t flush); */ isc_result_t -ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text); +ns_server_reloadcommand(ns_server_t *server, isc_lex_t *lex, + isc_buffer_t *text); /*%< * Act on a "reload" command from the command channel. */ @@ -235,26 +234,28 @@ ns_server_reconfigcommand(ns_server_t *server); */ isc_result_t -ns_server_notifycommand(ns_server_t *server, char *args, isc_buffer_t *text); +ns_server_notifycommand(ns_server_t *server, isc_lex_t *lex, + isc_buffer_t *text); /*%< * Act on a "notify" command from the command channel. */ isc_result_t -ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t *text); +ns_server_refreshcommand(ns_server_t *server, isc_lex_t *lex, + isc_buffer_t *text); /*%< * Act on a "refresh" command from the command channel. */ isc_result_t -ns_server_retransfercommand(ns_server_t *server, char *args, +ns_server_retransfercommand(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text); /*%< * Act on a "retransfer" command from the command channel. */ isc_result_t -ns_server_togglequerylog(ns_server_t *server, char *args); +ns_server_togglequerylog(ns_server_t *server, isc_lex_t *lex); /*%< * Enable/disable logging of queries. (Takes "yes" or "no" argument, * but can also be used as a toggle for backward comptibility.) @@ -270,25 +271,25 @@ ns_server_dumpstats(ns_server_t *server); * Dump the current cache to the dump file. */ isc_result_t -ns_server_dumpdb(ns_server_t *server, char *args); +ns_server_dumpdb(ns_server_t *server, isc_lex_t *lex); /*% * Dump the current security roots to the secroots file. */ isc_result_t -ns_server_dumpsecroots(ns_server_t *server, char *args); +ns_server_dumpsecroots(ns_server_t *server, isc_lex_t *lex); /*% * Change or increment the server debug level. */ isc_result_t -ns_server_setdebuglevel(ns_server_t *server, char *args); +ns_server_setdebuglevel(ns_server_t *server, isc_lex_t *lex); /*% * Flush the server's cache(s) */ isc_result_t -ns_server_flushcache(ns_server_t *server, char *args); +ns_server_flushcache(ns_server_t *server, isc_lex_t *lex); /*% * Flush a particular name from the server's cache. If 'tree' is false, @@ -296,7 +297,8 @@ ns_server_flushcache(ns_server_t *server, char *args); * flush all the names under the specified name. */ isc_result_t -ns_server_flushnode(ns_server_t *server, char *args, isc_boolean_t tree); +ns_server_flushnode(ns_server_t *server, isc_lex_t *lex, + isc_boolean_t tree); /*% * Report the server's status. @@ -314,20 +316,21 @@ ns_server_tsiglist(ns_server_t *server, isc_buffer_t *text); * Delete a specific key (with optional view). */ isc_result_t -ns_server_tsigdelete(ns_server_t *server, char *command, isc_buffer_t *text); +ns_server_tsigdelete(ns_server_t *server, isc_lex_t *lex, + isc_buffer_t *text); /*% * Enable or disable updates for a zone. */ isc_result_t -ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args, - isc_buffer_t *text); +ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, + isc_lex_t *lex, isc_buffer_t *text); /*% * Dump zone updates to disk, optionally removing the journal file */ isc_result_t -ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text); +ns_server_sync(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text); /*% * Update a zone's DNSKEY set from the key repository. If @@ -337,7 +340,7 @@ ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text); * take place incrementally. */ isc_result_t -ns_server_rekey(ns_server_t *server, char *args, isc_buffer_t *text); +ns_server_rekey(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text); /*% * Dump the current recursive queries. @@ -355,7 +358,7 @@ ns_add_reserved_dispatch(ns_server_t *server, const isc_sockaddr_t *addr); * Enable or disable dnssec validation. */ isc_result_t -ns_server_validation(ns_server_t *server, char *args); +ns_server_validation(ns_server_t *server, isc_lex_t *lex); /*% * Add a zone to a running process @@ -367,11 +370,11 @@ ns_server_add_zone(ns_server_t *server, char *args, isc_buffer_t *text); * Deletes a zone from a running process */ isc_result_t -ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text); +ns_server_del_zone(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text); /*% * Lists the status of the signing records for a given zone. */ isc_result_t -ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text); +ns_server_signing(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text); #endif /* NAMED_SERVER_H */ diff --git a/contrib/bind9/bin/named/lwdgrbn.c b/contrib/bind9/bin/named/lwdgrbn.c index 3e7b15bbd..85dbafdc2 100644 --- a/contrib/bind9/bin/named/lwdgrbn.c +++ b/contrib/bind9/bin/named/lwdgrbn.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -184,7 +184,7 @@ iterate_node(lwres_grbnresponse_t *grbn, dns_db_t *db, dns_dbnode_t *node, if (oldlens != NULL) isc_mem_put(mctx, oldlens, oldsize * sizeof(*oldlens)); if (newrdatas != NULL) - isc_mem_put(mctx, newrdatas, used * sizeof(*oldrdatas)); + isc_mem_put(mctx, newrdatas, used * sizeof(*newrdatas)); return (result); } @@ -403,14 +403,18 @@ start_lookup(ns_lwdclient_t *client) { INSIST(client->lookup == NULL); dns_fixedname_init(&absname); - result = ns_lwsearchctx_current(&client->searchctx, - dns_fixedname_name(&absname)); + /* - * This will return failure if relative name + suffix is too long. - * In this case, just go on to the next entry in the search path. + * Perform search across all search domains until success + * is returned. Return in case of failure. */ - if (result != ISC_R_SUCCESS) - start_lookup(client); + while (ns_lwsearchctx_current(&client->searchctx, + dns_fixedname_name(&absname)) != ISC_R_SUCCESS) { + if (ns_lwsearchctx_next(&client->searchctx) != ISC_R_SUCCESS) { + ns_lwdclient_errorpktsend(client, LWRES_R_FAILURE); + return; + } + } result = dns_lookup_create(cm->mctx, dns_fixedname_name(&absname), diff --git a/contrib/bind9/bin/named/lwresd.8 b/contrib/bind9/bin/named/lwresd.8 index 400e8a7e5..5c209ea05 100644 --- a/contrib/bind9/bin/named/lwresd.8 +++ b/contrib/bind9/bin/named/lwresd.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007-2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007-2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,70 +13,85 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwresd .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: January 20, 2009 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2009-01-20 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRESD" "8" "January 20, 2009" "BIND9" "BIND9" +.TH "LWRESD" "8" "2009\-01\-20" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwresd \- lightweight resolver daemon .SH "SYNOPSIS" -.HP 7 +.HP \w'\fBlwresd\fR\ 'u \fBlwresd\fR [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-C\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-i\ \fR\fB\fIpid\-file\fR\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-P\ \fR\fB\fIport\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-4\fR] [\fB\-6\fR] .SH "DESCRIPTION" .PP \fBlwresd\fR -is the daemon providing name lookup services to clients that use the BIND 9 lightweight resolver library. It is essentially a stripped\-down, caching\-only name server that answers queries using the BIND 9 lightweight resolver protocol rather than the DNS protocol. +is the daemon providing name lookup services to clients that use the BIND 9 lightweight resolver library\&. It is essentially a stripped\-down, caching\-only name server that answers queries using the BIND 9 lightweight resolver protocol rather than the DNS protocol\&. .PP \fBlwresd\fR -listens for resolver queries on a UDP port on the IPv4 loopback interface, 127.0.0.1. This means that +listens for resolver queries on a UDP port on the IPv4 loopback interface, 127\&.0\&.0\&.1\&. This means that \fBlwresd\fR -can only be used by processes running on the local machine. By default, UDP port number 921 is used for lightweight resolver requests and responses. +can only be used by processes running on the local machine\&. By default, UDP port number 921 is used for lightweight resolver requests and responses\&. .PP -Incoming lightweight resolver requests are decoded by the server which then resolves them using the DNS protocol. When the DNS lookup completes, +Incoming lightweight resolver requests are decoded by the server which then resolves them using the DNS protocol\&. When the DNS lookup completes, \fBlwresd\fR -encodes the answers in the lightweight resolver format and returns them to the client that made the request. +encodes the answers in the lightweight resolver format and returns them to the client that made the request\&. .PP If -\fI/etc/resolv.conf\fR +/etc/resolv\&.conf contains any \fBnameserver\fR entries, \fBlwresd\fR -sends recursive DNS queries to those servers. This is similar to the use of forwarders in a caching name server. If no +sends recursive DNS queries to those servers\&. This is similar to the use of forwarders in a caching name server\&. If no \fBnameserver\fR entries are present, or if forwarding fails, \fBlwresd\fR -resolves the queries autonomously starting at the root name servers, using a built\-in list of root server hints. +resolves the queries autonomously starting at the root name servers, using a built\-in list of root server hints\&. .SH "OPTIONS" .PP \-4 .RS 4 -Use IPv4 only even if the host machine is capable of IPv6. +Use IPv4 only even if the host machine is capable of IPv6\&. \fB\-4\fR and \fB\-6\fR -are mutually exclusive. +are mutually exclusive\&. .RE .PP \-6 .RS 4 -Use IPv6 only even if the host machine is capable of IPv4. +Use IPv6 only even if the host machine is capable of IPv4\&. \fB\-4\fR and \fB\-6\fR -are mutually exclusive. +are mutually exclusive\&. .RE .PP \-c \fIconfig\-file\fR @@ -84,10 +99,10 @@ are mutually exclusive. Use \fIconfig\-file\fR as the configuration file instead of the default, -\fI/etc/lwresd.conf\fR. +/etc/lwresd\&.conf\&. \fB\-c\fR can not be used with -\fB\-C\fR. +\fB\-C\fR\&. .RE .PP \-C \fIconfig\-file\fR @@ -95,29 +110,29 @@ can not be used with Use \fIconfig\-file\fR as the configuration file instead of the default, -\fI/etc/resolv.conf\fR. +/etc/resolv\&.conf\&. \fB\-C\fR can not be used with -\fB\-c\fR. +\fB\-c\fR\&. .RE .PP \-d \fIdebug\-level\fR .RS 4 -Set the daemon's debug level to -\fIdebug\-level\fR. Debugging traces from +Set the daemon\*(Aqs debug level to +\fIdebug\-level\fR\&. Debugging traces from \fBlwresd\fR -become more verbose as the debug level increases. +become more verbose as the debug level increases\&. .RE .PP \-f .RS 4 -Run the server in the foreground (i.e. do not daemonize). +Run the server in the foreground (i\&.e\&. do not daemonize)\&. .RE .PP \-g .RS 4 Run the server in the foreground and force all logging to -\fIstderr\fR. +stderr\&. .RE .PP \-i \fIpid\-file\fR @@ -125,49 +140,60 @@ Run the server in the foreground and force all logging to Use \fIpid\-file\fR as the PID file instead of the default, -\fI/var/run/lwresd/lwresd.pid\fR. +/var/run/lwresd/lwresd\&.pid\&. .RE .PP \-m \fIflag\fR .RS 4 -Turn on memory usage debugging flags. Possible flags are +Turn on memory usage debugging flags\&. Possible flags are \fIusage\fR, \fItrace\fR, \fIrecord\fR, \fIsize\fR, and -\fImctx\fR. These correspond to the ISC_MEM_DEBUGXXXX flags described in -\fI\fR. +\fImctx\fR\&. These correspond to the ISC_MEM_DEBUGXXXX flags described in +\&. .RE .PP \-n \fI#cpus\fR .RS 4 Create \fI#cpus\fR -worker threads to take advantage of multiple CPUs. If not specified, +worker threads to take advantage of multiple CPUs\&. If not specified, \fBlwresd\fR -will try to determine the number of CPUs present and create one thread per CPU. If it is unable to determine the number of CPUs, a single worker thread will be created. +will try to determine the number of CPUs present and create one thread per CPU\&. If it is unable to determine the number of CPUs, a single worker thread will be created\&. .RE .PP \-P \fIport\fR .RS 4 Listen for lightweight resolver queries on port -\fIport\fR. If not specified, the default is port 921. +\fIport\fR\&. If not specified, the default is port 921\&. .RE .PP \-p \fIport\fR .RS 4 Send DNS lookups to port -\fIport\fR. If not specified, the default is port 53. This provides a way of testing the lightweight resolver daemon with a name server that listens for queries on a non\-standard port number. +\fIport\fR\&. If not specified, the default is port 53\&. This provides a way of testing the lightweight resolver daemon with a name server that listens for queries on a non\-standard port number\&. .RE .PP \-s .RS 4 Write memory usage statistics to -\fIstdout\fR -on exit. -.RS -.B "Note:" -This option is mainly of interest to BIND 9 developers and may be removed or changed in a future release. +stdout +on exit\&. +.if n \{\ +.sp +.\} +.RS 4 +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.ps +1 +\fBNote\fR +.ps -1 +.br +This option is mainly of interest to BIND 9 developers and may be removed or changed in a future release\&. +.sp .5v .RE .RE .PP @@ -175,14 +201,25 @@ This option is mainly of interest to BIND 9 developers and may be removed or cha .RS 4 Chroot to \fIdirectory\fR -after processing the command line arguments, but before reading the configuration file. -.RS -.B "Warning:" +after processing the command line arguments, but before reading the configuration file\&. +.if n \{\ +.sp +.\} +.RS 4 +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.ps +1 +\fBWarning\fR +.ps -1 +.br This option should be used in conjunction with the \fB\-u\fR -option, as chrooting a process running as root doesn't enhance security on most systems; the way +option, as chrooting a process running as root doesn\*(Aqt enhance security on most systems; the way \fBchroot(2)\fR -is defined allows a process with root privileges to escape a chroot jail. +is defined allows a process with root privileges to escape a chroot jail\&. +.sp .5v .RE .RE .PP @@ -190,34 +227,35 @@ is defined allows a process with root privileges to escape a chroot jail. .RS 4 Setuid to \fIuser\fR -after completing privileged operations, such as creating sockets that listen on privileged ports. +after completing privileged operations, such as creating sockets that listen on privileged ports\&. .RE .PP \-v .RS 4 -Report the version number and exit. +Report the version number and exit\&. .RE .SH "FILES" .PP -\fI/etc/resolv.conf\fR +/etc/resolv\&.conf .RS 4 -The default configuration file. +The default configuration file\&. .RE .PP -\fI/var/run/lwresd.pid\fR +/var/run/lwresd\&.pid .RS 4 -The default process\-id file. +The default process\-id file\&. .RE .SH "SEE ALSO" .PP \fBnamed\fR(8), \fBlwres\fR(3), -\fBresolver\fR(5). +\fBresolver\fR(5)\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007\-2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007-2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/named/lwresd.docbook b/contrib/bind9/bin/named/lwresd.docbook index 307131ad8..6e3399ecb 100644 --- a/contrib/bind9/bin/named/lwresd.docbook +++ b/contrib/bind9/bin/named/lwresd.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2009-01-20 + - January 20, 2009 + ISC + Internet Systems Consortium, Inc. @@ -42,6 +44,7 @@ 2008 2009 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -52,29 +55,29 @@ - + lwresd - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + - - DESCRIPTION + DESCRIPTION + lwresd is the daemon providing name lookup @@ -84,7 +87,7 @@ resolver protocol rather than the DNS protocol. - lwresd + lwresd listens for resolver queries on a UDP port on the IPv4 loopback interface, 127.0.0.1. This means that lwresd can only be used by @@ -109,10 +112,10 @@ queries autonomously starting at the root name servers, using a built-in list of root server hints. - + + + OPTIONS - - OPTIONS @@ -214,7 +217,7 @@ trace, record, size, and - mctx. + mctx. These correspond to the ISC_MEM_DEBUGXXXX flags described in <isc/mem.h>. @@ -318,10 +321,10 @@ - + + + FILES - - FILES @@ -345,10 +348,10 @@ - + + + SEE ALSO - - SEE ALSO named8 , @@ -359,16 +362,6 @@ resolver5 . - - - - AUTHOR - Internet Systems Consortium - - + - + diff --git a/contrib/bind9/bin/named/lwresd.html b/contrib/bind9/bin/named/lwresd.html index 4bef3e262..c6afd57f6 100644 --- a/contrib/bind9/bin/named/lwresd.html +++ b/contrib/bind9/bin/named/lwresd.html @@ -1,5 +1,5 @@ - lwresd - + -
    -
    +
    +

    Name

    lwresd — lightweight resolver daemon

    @@ -31,19 +30,19 @@

    Synopsis

    lwresd [-c config-file] [-C config-file] [-d debug-level] [-f] [-g] [-i pid-file] [-m flag] [-n #cpus] [-P port] [-p port] [-s] [-t directory] [-u user] [-v] [-4] [-6]

    -
    -

    DESCRIPTION

    -

    lwresd +

    +

    DESCRIPTION

    +

    lwresd is the daemon providing name lookup services to clients that use the BIND 9 lightweight resolver library. It is essentially a stripped-down, caching-only name server that answers queries using the BIND 9 lightweight resolver protocol rather than the DNS protocol.

    -

    lwresd +

    lwresd listens for resolver queries on a UDP port on the IPv4 loopback interface, 127.0.0.1. This - means that lwresd can only be used by + means that lwresd can only be used by processes running on the local machine. By default, UDP port number 921 is used for lightweight resolver requests and responses. @@ -51,24 +50,24 @@

    Incoming lightweight resolver requests are decoded by the server which then resolves them using the DNS protocol. When - the DNS lookup completes, lwresd encodes + the DNS lookup completes, lwresd encodes the answers in the lightweight resolver format and returns them to the client that made the request.

    If /etc/resolv.conf contains any - nameserver entries, lwresd + nameserver entries, lwresd sends recursive DNS queries to those servers. This is similar to the use of forwarders in a caching name server. If no nameserver entries are present, or if - forwarding fails, lwresd resolves the + forwarding fails, lwresd resolves the queries autonomously starting at the root name servers, using a built-in list of root server hints.

    -
    -

    OPTIONS

    -
    +
    +

    OPTIONS

    +
    -4

    Use IPv4 only even if the host machine is capable of IPv6. @@ -99,7 +98,7 @@

    -d debug-level

    Set the daemon's debug level to debug-level. - Debugging traces from lwresd become + Debugging traces from lwresd become more verbose as the debug level increases.

    -f
    @@ -124,7 +123,7 @@ trace, record, size, and - mctx. + mctx. These correspond to the ISC_MEM_DEBUGXXXX flags described in <isc/mem.h>.

    @@ -132,7 +131,7 @@

    Create #cpus worker threads to take advantage of multiple CPUs. If not specified, - lwresd will try to determine the + lwresd will try to determine the number of CPUs present and create one thread per CPU. If it is unable to determine the number of CPUs, a single worker thread will be created. @@ -196,9 +195,9 @@

    -
    -

    FILES

    -
    +
    +

    FILES

    +
    /etc/resolv.conf

    The default configuration file. @@ -209,17 +208,12 @@

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    named(8), lwres(3), resolver(5).

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/named/main.c b/contrib/bind9/bin/named/main.c index 5664e6545..539366d8b 100644 --- a/contrib/bind9/bin/named/main.c +++ b/contrib/bind9/bin/named/main.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -298,11 +298,13 @@ static void lwresd_usage(void) { fprintf(stderr, "usage: lwresd [-4|-6] [-c conffile | -C resolvconffile] " - "[-d debuglevel]\n" - " [-f|-g] [-n number_of_cpus] [-p port] " - "[-P listen-port] [-s]\n" - " [-t chrootdir] [-u username] [-i pidfile]\n" - " [-m {usage|trace|record|size|mctx}]\n"); + "[-d debuglevel] [-f|-g]\n" + " [-i pidfile] [-n number_of_cpus] " + "[-p port] [-P listen-port]\n" + " [-s] [-S sockets] [-t chrootdir] [-u username] " + "[-U listeners]\n" + " [-m {usage|trace|record|size|mctx}]\n" + "usage: lwresd [-v|-V]\n"); } static void @@ -315,8 +317,10 @@ usage(void) { "usage: named [-4|-6] [-c conffile] [-d debuglevel] " "[-E engine] [-f|-g]\n" " [-n number_of_cpus] [-p port] [-s] " - "[-t chrootdir] [-u username]\n" - " [-m {usage|trace|record|size|mctx}]\n"); + "[-S sockets] [-t chrootdir]\n" + " [-u username] [-U listeners] " + "[-m {usage|trace|record|size|mctx}]\n" + "usage: named [-v|-V]\n"); } static void @@ -609,6 +613,7 @@ parse_command_line(int argc, char *argv[]) { printf("%s %s%s%s \n", ns_g_product, ns_g_version, (*ns_g_description != '\0') ? " " : "", ns_g_description, ns_g_srcid); + printf("running on %s\n", ns_os_uname()); printf("built by %s with %s\n", ns_g_builder, ns_g_configargs); #ifdef __clang__ @@ -677,6 +682,8 @@ create_managers(void) { isc_result_t result; unsigned int socks; + INSIST(ns_g_cpus_detected > 0); + #ifdef ISC_PLATFORM_USETHREADS if (ns_g_cpus == 0) ns_g_cpus = ns_g_cpus_detected; @@ -693,10 +700,8 @@ create_managers(void) { if (ns_g_udpdisp == 0) { if (ns_g_cpus_detected == 1) ns_g_udpdisp = 1; - else if (ns_g_cpus_detected < 4) - ns_g_udpdisp = 2; else - ns_g_udpdisp = ns_g_cpus_detected / 2; + ns_g_udpdisp = ns_g_cpus_detected - 1; } if (ns_g_udpdisp > ns_g_cpus) ns_g_udpdisp = ns_g_cpus; @@ -908,6 +913,9 @@ setup(void) { *ns_g_description ? " " : "", ns_g_description, ns_g_srcid, saved_command_line); + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN, + ISC_LOG_NOTICE, "running on %s", ns_os_uname()); + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN, ISC_LOG_NOTICE, "built with %s", ns_g_configargs); diff --git a/contrib/bind9/bin/named/named.8 b/contrib/bind9/bin/named/named.8 index 09bd4c117..23e35e580 100644 --- a/contrib/bind9/bin/named/named.8 +++ b/contrib/bind9/bin/named/named.8 @@ -13,54 +13,69 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: named .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: February 20, 2014 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2014-02-20 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "NAMED" "8" "February 20, 2014" "BIND9" "BIND9" +.TH "NAMED" "8" "2014\-02\-20" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" named \- Internet domain name server .SH "SYNOPSIS" -.HP 6 +.HP \w'\fBnamed\fR\ 'u \fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-E\ \fR\fB\fIengine\-name\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-M\ \fR\fB\fIoption\fR\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-S\ \fR\fB\fI#max\-socks\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-U\ \fR\fB\fI#listeners\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-V\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR] .SH "DESCRIPTION" .PP \fBnamed\fR -is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more information on the DNS, see RFCs 1033, 1034, and 1035. +is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC\&. For more information on the DNS, see RFCs 1033, 1034, and 1035\&. .PP When invoked without arguments, \fBnamed\fR will read the default configuration file -\fI/etc/named.conf\fR, read any initial data, and listen for queries. +/etc/named\&.conf, read any initial data, and listen for queries\&. .SH "OPTIONS" .PP \-4 .RS 4 -Use IPv4 only even if the host machine is capable of IPv6. +Use IPv4 only even if the host machine is capable of IPv6\&. \fB\-4\fR and \fB\-6\fR -are mutually exclusive. +are mutually exclusive\&. .RE .PP \-6 .RS 4 -Use IPv6 only even if the host machine is capable of IPv4. +Use IPv6 only even if the host machine is capable of IPv4\&. \fB\-4\fR and \fB\-6\fR -are mutually exclusive. +are mutually exclusive\&. .RE .PP \-c \fIconfig\-file\fR @@ -68,79 +83,90 @@ are mutually exclusive. Use \fIconfig\-file\fR as the configuration file instead of the default, -\fI/etc/named.conf\fR. To ensure that reloading the configuration file continues to work after the server has changed its working directory due to to a possible +/etc/named\&.conf\&. To ensure that reloading the configuration file continues to work after the server has changed its working directory due to to a possible \fBdirectory\fR option in the configuration file, \fIconfig\-file\fR -should be an absolute pathname. +should be an absolute pathname\&. .RE .PP \-d \fIdebug\-level\fR .RS 4 -Set the daemon's debug level to -\fIdebug\-level\fR. Debugging traces from +Set the daemon\*(Aqs debug level to +\fIdebug\-level\fR\&. Debugging traces from \fBnamed\fR -become more verbose as the debug level increases. +become more verbose as the debug level increases\&. .RE .PP \-E \fIengine\-name\fR .RS 4 -Use a crypto hardware (OpenSSL engine) for the crypto operations it supports, for instance re\-signing with private keys from a secure key store. When compiled with PKCS#11 support +Use a crypto hardware (OpenSSL engine) for the crypto operations it supports, for instance re\-signing with private keys from a secure key store\&. When compiled with PKCS#11 support \fIengine\-name\fR -defaults to pkcs11, the empty name resets it to no engine. +defaults to pkcs11, the empty name resets it to no engine\&. .RE .PP \-f .RS 4 -Run the server in the foreground (i.e. do not daemonize). +Run the server in the foreground (i\&.e\&. do not daemonize)\&. .RE .PP \-g .RS 4 Run the server in the foreground and force all logging to -\fIstderr\fR. +stderr\&. .RE .PP \-M \fIoption\fR .RS 4 -Sets the default memory context options. Currently the only supported option is -\fIexternal\fR, which causes the internal memory manager to be bypassed in favor of system\-provided memory allocation functions. +Sets the default memory context options\&. Currently the only supported option is +\fIexternal\fR, which causes the internal memory manager to be bypassed in favor of system\-provided memory allocation functions\&. .RE .PP \-m \fIflag\fR .RS 4 -Turn on memory usage debugging flags. Possible flags are +Turn on memory usage debugging flags\&. Possible flags are \fIusage\fR, \fItrace\fR, \fIrecord\fR, \fIsize\fR, and -\fImctx\fR. These correspond to the ISC_MEM_DEBUGXXXX flags described in -\fI\fR. +\fImctx\fR\&. These correspond to the ISC_MEM_DEBUGXXXX flags described in +\&. .RE .PP \-n \fI#cpus\fR .RS 4 Create \fI#cpus\fR -worker threads to take advantage of multiple CPUs. If not specified, +worker threads to take advantage of multiple CPUs\&. If not specified, \fBnamed\fR -will try to determine the number of CPUs present and create one thread per CPU. If it is unable to determine the number of CPUs, a single worker thread will be created. +will try to determine the number of CPUs present and create one thread per CPU\&. If it is unable to determine the number of CPUs, a single worker thread will be created\&. .RE .PP \-p \fIport\fR .RS 4 Listen for queries on port -\fIport\fR. If not specified, the default is port 53. +\fIport\fR\&. If not specified, the default is port 53\&. .RE .PP \-s .RS 4 Write memory usage statistics to -\fIstdout\fR -on exit. -.RS -.B "Note:" -This option is mainly of interest to BIND 9 developers and may be removed or changed in a future release. +stdout +on exit\&. +.if n \{\ +.sp +.\} +.RS 4 +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.ps +1 +\fBNote\fR +.ps -1 +.br +This option is mainly of interest to BIND 9 developers and may be removed or changed in a future release\&. +.sp .5v .RE .RE .PP @@ -150,12 +176,23 @@ Allow \fBnamed\fR to use up to \fI#max\-socks\fR -sockets. -.RS -.B "Warning:" -This option should be unnecessary for the vast majority of users. The use of this option could even be harmful because the specified value may exceed the limitation of the underlying system API. It is therefore set only when the default configuration causes exhaustion of file descriptors and the operational environment is known to support the specified number of sockets. Note also that the actual maximum number is normally a little fewer than the specified value because +sockets\&. +.if n \{\ +.sp +.\} +.RS 4 +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.ps +1 +\fBWarning\fR +.ps -1 +.br +This option should be unnecessary for the vast majority of users\&. The use of this option could even be harmful because the specified value may exceed the limitation of the underlying system API\&. It is therefore set only when the default configuration causes exhaustion of file descriptors and the operational environment is known to support the specified number of sockets\&. Note also that the actual maximum number is normally a little fewer than the specified value because \fBnamed\fR -reserves some file descriptors for its internal use. +reserves some file descriptors for its internal use\&. +.sp .5v .RE .RE .PP @@ -163,14 +200,25 @@ reserves some file descriptors for its internal use. .RS 4 Chroot to \fIdirectory\fR -after processing the command line arguments, but before reading the configuration file. -.RS -.B "Warning:" +after processing the command line arguments, but before reading the configuration file\&. +.if n \{\ +.sp +.\} +.RS 4 +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.ps +1 +\fBWarning\fR +.ps -1 +.br This option should be used in conjunction with the \fB\-u\fR -option, as chrooting a process running as root doesn't enhance security on most systems; the way +option, as chrooting a process running as root doesn\*(Aqt enhance security on most systems; the way \fBchroot(2)\fR -is defined allows a process with root privileges to escape a chroot jail. +is defined allows a process with root privileges to escape a chroot jail\&. +.sp .5v .RE .RE .PP @@ -178,115 +226,138 @@ is defined allows a process with root privileges to escape a chroot jail. .RS 4 Use \fI#listeners\fR -worker threads to listen for incoming UDP packets on each address. If not specified, +worker threads to listen for incoming UDP packets on each address\&. If not specified, \fBnamed\fR -will calculate a default value based on the number of detected CPUs: 1 for 1 CPU, 2 for 2\-4 CPUs, and the number of detected CPUs divided by 2 for values higher than 4. If +will calculate a default value based on the number of detected CPUs: 1 for 1 CPU, and the number of detected CPUs minus one for machines with more than 1 CPU\&. This cannot be increased to a value higher than the number of CPUs\&. If \fB\-n\fR has been set to a higher value than the number of detected CPUs, then \fB\-U\fR -may be increased as high as that value, but no higher. +may be increased as high as that value, but no higher\&. On Windows, the number of UDP listeners is hardwired to 1 and this option has no effect\&. .RE .PP \-u \fIuser\fR .RS 4 Setuid to \fIuser\fR -after completing privileged operations, such as creating sockets that listen on privileged ports. -.RS -.B "Note:" +after completing privileged operations, such as creating sockets that listen on privileged ports\&. +.if n \{\ +.sp +.\} +.RS 4 +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.ps +1 +\fBNote\fR +.ps -1 +.br On Linux, \fBnamed\fR -uses the kernel's capability mechanism to drop all root privileges except the ability to +uses the kernel\*(Aqs capability mechanism to drop all root privileges except the ability to \fBbind(2)\fR -to a privileged port and set process resource limits. Unfortunately, this means that the +to a privileged port and set process resource limits\&. Unfortunately, this means that the \fB\-u\fR option only works when \fBnamed\fR -is run on kernel 2.2.18 or later, or kernel 2.3.99\-pre3 or later, since previous kernels did not allow privileges to be retained after -\fBsetuid(2)\fR. +is run on kernel 2\&.2\&.18 or later, or kernel 2\&.3\&.99\-pre3 or later, since previous kernels did not allow privileges to be retained after +\fBsetuid(2)\fR\&. +.sp .5v .RE .RE .PP \-v .RS 4 -Report the version number and exit. +Report the version number and exit\&. .RE .PP \-V .RS 4 -Report the version number and build options, and exit. +Report the version number and build options, and exit\&. .RE .PP \-x \fIcache\-file\fR .RS 4 Load data from \fIcache\-file\fR -into the cache of the default view. -.RS -.B "Warning:" -This option must not be used. It is only of interest to BIND 9 developers and may be removed or changed in a future release. +into the cache of the default view\&. +.if n \{\ +.sp +.\} +.RS 4 +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.br +.ps +1 +\fBWarning\fR +.ps -1 +.br +This option must not be used\&. It is only of interest to BIND 9 developers and may be removed or changed in a future release\&. +.sp .5v .RE .RE .SH "SIGNALS" .PP In routine operation, signals should not be used to control the nameserver; \fBrndc\fR -should be used instead. +should be used instead\&. .PP SIGHUP .RS 4 -Force a reload of the server. +Force a reload of the server\&. .RE .PP SIGINT, SIGTERM .RS 4 -Shut down the server. +Shut down the server\&. .RE .PP -The result of sending any other signals to the server is undefined. +The result of sending any other signals to the server is undefined\&. .SH "CONFIGURATION" .PP The \fBnamed\fR -configuration file is too complex to describe in detail here. A complete description is provided in the -BIND 9 Administrator Reference Manual. +configuration file is too complex to describe in detail here\&. A complete description is provided in the +BIND 9 Administrator Reference Manual\&. .PP \fBnamed\fR inherits the \fBumask\fR -(file creation mode mask) from the parent process. If files created by +(file creation mode mask) from the parent process\&. If files created by \fBnamed\fR, such as journal files, need to have custom permissions, the \fBumask\fR should be set explicitly in the script used to start the \fBnamed\fR -process. +process\&. .SH "FILES" .PP -\fI/etc/named.conf\fR +/etc/named\&.conf .RS 4 -The default configuration file. +The default configuration file\&. .RE .PP -\fI/var/run/named/named.pid\fR +/var/run/named/named\&.pid .RS 4 -The default process\-id file. +The default process\-id file\&. .RE .SH "SEE ALSO" .PP RFC 1033, RFC 1034, RFC 1035, -\fBnamed\-checkconf\fR(8), -\fBnamed\-checkzone\fR(8), +\fBnamed-checkconf\fR(8), +\fBnamed-checkzone\fR(8), \fBrndc\fR(8), \fBlwresd\fR(8), \fBnamed.conf\fR(5), -BIND 9 Administrator Reference Manual. +BIND 9 Administrator Reference Manual\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004\-2009, 2011, 2013\-2015 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004-2009, 2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001, 2003 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/named/named.conf.5 b/contrib/bind9/bin/named/named.conf.5 index c4d75437d..532e83def 100644 --- a/contrib/bind9/bin/named/named.conf.5 +++ b/contrib/bind9/bin/named/named.conf.5 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,32 +12,47 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: \fInamed.conf\fR +'\" t +.\" Title: named.conf .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: January 08, 2014 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2014-01-08 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "\fINAMED.CONF\fR" "5" "January 08, 2014" "BIND9" "BIND9" +.TH "NAMED\&.CONF" "5" "2014\-01\-08" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" named.conf \- configuration file for named .SH "SYNOPSIS" -.HP 11 -\fBnamed.conf\fR +.HP \w'\fBnamed\&.conf\fR\ 'u +\fBnamed\&.conf\fR .SH "DESCRIPTION" .PP -\fInamed.conf\fR +named\&.conf is the configuration file for -\fBnamed\fR. Statements are enclosed in braces and terminated with a semi\-colon. Clauses in the statements are also semi\-colon terminated. The usual comment styles are supported: +\fBnamed\fR\&. Statements are enclosed in braces and terminated with a semi\-colon\&. Clauses in the statements are also semi\-colon terminated\&. The usual comment styles are supported: .PP C style: /* */ .PP @@ -46,34 +61,48 @@ C++ style: // to end of line Unix style: # to end of line .SH "ACL" .sp +.if n \{\ .RS 4 +.\} .nf -acl \fIstring\fR { \fIaddress_match_element\fR; ... }; +acl \fIstring\fR { \fIaddress_match_element\fR; \&.\&.\&. }; .fi +.if n \{\ .RE +.\} .SH "KEY" .sp +.if n \{\ .RS 4 +.\} .nf key \fIdomain_name\fR { algorithm \fIstring\fR; secret \fIstring\fR; }; .fi +.if n \{\ .RE +.\} .SH "MASTERS" .sp +.if n \{\ .RS 4 +.\} .nf masters \fIstring\fR [ port \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [port \fIinteger\fR] | - \fIipv6_address\fR [port \fIinteger\fR] ) [ key \fIstring\fR ]; ... + \fIipv6_address\fR [port \fIinteger\fR] ) [ key \fIstring\fR ]; \&.\&.\&. }; .fi +.if n \{\ .RE +.\} .SH "SERVER" .sp +.if n \{\ .RS 4 +.\} .nf server ( \fIipv4_address\fR\fI[/prefixlen]\fR | \fIipv6_address\fR\fI[/prefixlen]\fR ) { bogus \fIboolean\fR; @@ -92,41 +121,57 @@ server ( \fIipv4_address\fR\fI[/prefixlen]\fR | \fIipv6_address\fR\fI[/prefixlen support\-ixfr \fIboolean\fR; // obsolete }; .fi +.if n \{\ .RE -.SH "TRUSTED\-KEYS" +.\} +.SH "TRUSTED-KEYS" .sp +.if n \{\ .RS 4 +.\} .nf trusted\-keys { - \fIdomain_name\fR \fIflags\fR \fIprotocol\fR \fIalgorithm\fR \fIkey\fR; ... + \fIdomain_name\fR \fIflags\fR \fIprotocol\fR \fIalgorithm\fR \fIkey\fR; \&.\&.\&. }; .fi +.if n \{\ .RE -.SH "MANAGED\-KEYS" +.\} +.SH "MANAGED-KEYS" .sp +.if n \{\ .RS 4 +.\} .nf managed\-keys { - \fIdomain_name\fR \fBinitial\-key\fR \fIflags\fR \fIprotocol\fR \fIalgorithm\fR \fIkey\fR; ... + \fIdomain_name\fR \fBinitial\-key\fR \fIflags\fR \fIprotocol\fR \fIalgorithm\fR \fIkey\fR; \&.\&.\&. }; .fi +.if n \{\ .RE +.\} .SH "CONTROLS" .sp +.if n \{\ .RS 4 +.\} .nf controls { inet ( \fIipv4_address\fR | \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ] - allow { \fIaddress_match_element\fR; ... } - [ keys { \fIstring\fR; ... } ]; + allow { \fIaddress_match_element\fR; \&.\&.\&. } + [ keys { \fIstring\fR; \&.\&.\&. } ]; unix \fIunsupported\fR; // not implemented }; .fi +.if n \{\ .RE +.\} .SH "LOGGING" .sp +.if n \{\ .RS 4 +.\} .nf logging { channel \fIstring\fR { @@ -139,32 +184,40 @@ logging { print\-severity \fIboolean\fR; print\-category \fIboolean\fR; }; - category \fIstring\fR { \fIstring\fR; ... }; + category \fIstring\fR { \fIstring\fR; \&.\&.\&. }; }; .fi +.if n \{\ .RE +.\} .SH "LWRES" .sp +.if n \{\ .RS 4 +.\} .nf lwres { listen\-on [ port \fIinteger\fR ] { - ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; ... + ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&. }; view \fIstring\fR \fIoptional_class\fR; - search { \fIstring\fR; ... }; + search { \fIstring\fR; \&.\&.\&. }; ndots \fIinteger\fR; }; .fi +.if n \{\ .RE +.\} .SH "OPTIONS" .sp +.if n \{\ .RS 4 +.\} .nf options { - avoid\-v4\-udp\-ports { \fIport\fR; ... }; - avoid\-v6\-udp\-ports { \fIport\fR; ... }; - blackhole { \fIaddress_match_element\fR; ... }; + avoid\-v4\-udp\-ports { \fIport\fR; \&.\&.\&. }; + avoid\-v6\-udp\-ports { \fIport\fR; \&.\&.\&. }; + blackhole { \fIaddress_match_element\fR; \&.\&.\&. }; coresize \fIsize\fR; datasize \fIsize\fR; directory \fIquoted_string\fR; @@ -175,8 +228,8 @@ options { host\-statistics\-max \fInumber\fR; // not implemented hostname ( \fIquoted_string\fR | none ); interface\-interval \fIinteger\fR; - listen\-on [ port \fIinteger\fR ] { \fIaddress_match_element\fR; ... }; - listen\-on\-v6 [ port \fIinteger\fR ] { \fIaddress_match_element\fR; ... }; + listen\-on [ port \fIinteger\fR ] { \fIaddress_match_element\fR; \&.\&.\&. }; + listen\-on\-v6 [ port \fIinteger\fR ] { \fIaddress_match_element\fR; \&.\&.\&. }; match\-mapped\-addresses \fIboolean\fR; memstatistics\-file \fIquoted_string\fR; pid\-file ( \fIquoted_string\fR | none ); @@ -200,18 +253,17 @@ options { transfers\-per\-ns \fIinteger\fR; transfers\-in \fIinteger\fR; transfers\-out \fIinteger\fR; - use\-ixfr \fIboolean\fR; version ( \fIquoted_string\fR | none ); - allow\-recursion { \fIaddress_match_element\fR; ... }; - allow\-recursion\-on { \fIaddress_match_element\fR; ... }; - sortlist { \fIaddress_match_element\fR; ... }; - topology { \fIaddress_match_element\fR; ... }; // not implemented + allow\-recursion { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-recursion\-on { \fIaddress_match_element\fR; \&.\&.\&. }; + sortlist { \fIaddress_match_element\fR; \&.\&.\&. }; + topology { \fIaddress_match_element\fR; \&.\&.\&. }; // not implemented auth\-nxdomain \fIboolean\fR; // default changed minimal\-responses \fIboolean\fR; recursion \fIboolean\fR; rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] - [ name \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; ... + [ name \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; \&.\&.\&. }; provide\-ixfr \fIboolean\fR; request\-ixfr \fIboolean\fR; @@ -246,12 +298,12 @@ options { dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [port \fIinteger\fR] | \fIipv4_address\fR [port \fIinteger\fR] | - \fIipv6_address\fR [port \fIinteger\fR] ); ... + \fIipv6_address\fR [port \fIinteger\fR] ); \&.\&.\&. }; edns\-udp\-size \fIinteger\fR; max\-udp\-size \fIinteger\fR; - root\-delegation\-only [ exclude { \fIquoted_string\fR; ... } ]; - disable\-algorithms \fIstring\fR { \fIstring\fR; ... }; + root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ]; + disable\-algorithms \fIstring\fR { \fIstring\fR; \&.\&.\&. }; dnssec\-enable \fIboolean\fR; dnssec\-validation \fIboolean\fR; dnssec\-lookaside ( \fIauto\fR | \fIno\fR | \fIdomain\fR trust\-anchor \fIdomain\fR ); @@ -273,13 +325,13 @@ options { disable\-empty\-zone \fIstring\fR; dialup \fIdialuptype\fR; ixfr\-from\-differences \fIixfrdiff\fR; - allow\-query { \fIaddress_match_element\fR; ... }; - allow\-query\-on { \fIaddress_match_element\fR; ... }; - allow\-query\-cache { \fIaddress_match_element\fR; ... }; - allow\-query\-cache\-on { \fIaddress_match_element\fR; ... }; - allow\-transfer { \fIaddress_match_element\fR; ... }; - allow\-update { \fIaddress_match_element\fR; ... }; - allow\-update\-forwarding { \fIaddress_match_element\fR; ... }; + allow\-query { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-query\-on { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-query\-cache { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-query\-cache\-on { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-transfer { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-update { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-update\-forwarding { \fIaddress_match_element\fR; \&.\&.\&. }; update\-check\-ksk \fIboolean\fR; dnssec\-dnskey\-kskonly \fIboolean\fR; masterfile\-format ( text | raw ); @@ -289,12 +341,12 @@ options { notify\-delay \fIseconds\fR; notify\-to\-soa \fIboolean\fR; also\-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR ) - [ port \fIinteger\fR ]; ... - [ key \fIkeyname\fR ] ... }; - allow\-notify { \fIaddress_match_element\fR; ... }; + [ port \fIinteger\fR ]; \&.\&.\&. + [ key \fIkeyname\fR ] \&.\&.\&. }; + allow\-notify { \fIaddress_match_element\fR; \&.\&.\&. }; forward ( first | only ); forwarders [ port \fIinteger\fR ] { - ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; ... + ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&. }; max\-journal\-size \fIsize_no_default\fR; max\-transfer\-time\-in \fIinteger\fR; @@ -335,7 +387,7 @@ options { \fInamelist\fR } [ except\-from { \fInamelist\fR } ]; nsec3\-test\-zone \fIboolean\fR; // testing only - allow\-v6\-synthesis { \fIaddress_match_element\fR; ... }; // obsolete + allow\-v6\-synthesis { \fIaddress_match_element\fR; \&.\&.\&. }; // obsolete deallocate\-on\-exit \fIboolean\fR; // obsolete fake\-iquery \fIboolean\fR; // obsolete fetch\-glue \fIboolean\fR; // obsolete @@ -347,41 +399,46 @@ options { serial\-queries \fIinteger\fR; // obsolete treat\-cr\-as\-space \fIboolean\fR; // obsolete use\-id\-pool \fIboolean\fR; // obsolete + use\-ixfr \fIboolean\fR; // obsolete }; .fi +.if n \{\ .RE +.\} .SH "VIEW" .sp +.if n \{\ .RS 4 +.\} .nf view \fIstring\fR \fIoptional_class\fR { - match\-clients { \fIaddress_match_element\fR; ... }; - match\-destinations { \fIaddress_match_element\fR; ... }; + match\-clients { \fIaddress_match_element\fR; \&.\&.\&. }; + match\-destinations { \fIaddress_match_element\fR; \&.\&.\&. }; match\-recursive\-only \fIboolean\fR; key \fIstring\fR { algorithm \fIstring\fR; secret \fIstring\fR; }; zone \fIstring\fR \fIoptional_class\fR { - ... + \&.\&.\&. }; server ( \fIipv4_address\fR\fI[/prefixlen]\fR | \fIipv6_address\fR\fI[/prefixlen]\fR ) { - ... + \&.\&.\&. }; trusted\-keys { \fIstring\fR \fIinteger\fR \fIinteger\fR \fIinteger\fR \fIquoted_string\fR; - [...] + [\&.\&.\&.] }; - allow\-recursion { \fIaddress_match_element\fR; ... }; - allow\-recursion\-on { \fIaddress_match_element\fR; ... }; - sortlist { \fIaddress_match_element\fR; ... }; - topology { \fIaddress_match_element\fR; ... }; // not implemented + allow\-recursion { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-recursion\-on { \fIaddress_match_element\fR; \&.\&.\&. }; + sortlist { \fIaddress_match_element\fR; \&.\&.\&. }; + topology { \fIaddress_match_element\fR; \&.\&.\&. }; // not implemented auth\-nxdomain \fIboolean\fR; // default changed minimal\-responses \fIboolean\fR; recursion \fIboolean\fR; rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] - [ name \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; ... + [ name \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; \&.\&.\&. }; provide\-ixfr \fIboolean\fR; request\-ixfr \fIboolean\fR; @@ -416,12 +473,12 @@ view \fIstring\fR \fIoptional_class\fR { dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [port \fIinteger\fR] | \fIipv4_address\fR [port \fIinteger\fR] | - \fIipv6_address\fR [port \fIinteger\fR] ); ... + \fIipv6_address\fR [port \fIinteger\fR] ); \&.\&.\&. }; edns\-udp\-size \fIinteger\fR; max\-udp\-size \fIinteger\fR; - root\-delegation\-only [ exclude { \fIquoted_string\fR; ... } ]; - disable\-algorithms \fIstring\fR { \fIstring\fR; ... }; + root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ]; + disable\-algorithms \fIstring\fR { \fIstring\fR; \&.\&.\&. }; dnssec\-enable \fIboolean\fR; dnssec\-validation \fIboolean\fR; dnssec\-lookaside ( \fIauto\fR | \fIno\fR | \fIdomain\fR trust\-anchor \fIdomain\fR ); @@ -443,13 +500,13 @@ view \fIstring\fR \fIoptional_class\fR { disable\-empty\-zone \fIstring\fR; dialup \fIdialuptype\fR; ixfr\-from\-differences \fIixfrdiff\fR; - allow\-query { \fIaddress_match_element\fR; ... }; - allow\-query\-on { \fIaddress_match_element\fR; ... }; - allow\-query\-cache { \fIaddress_match_element\fR; ... }; - allow\-query\-cache\-on { \fIaddress_match_element\fR; ... }; - allow\-transfer { \fIaddress_match_element\fR; ... }; - allow\-update { \fIaddress_match_element\fR; ... }; - allow\-update\-forwarding { \fIaddress_match_element\fR; ... }; + allow\-query { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-query\-on { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-query\-cache { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-query\-cache\-on { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-transfer { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-update { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-update\-forwarding { \fIaddress_match_element\fR; \&.\&.\&. }; update\-check\-ksk \fIboolean\fR; dnssec\-dnskey\-kskonly \fIboolean\fR; masterfile\-format ( text | raw ); @@ -459,12 +516,12 @@ view \fIstring\fR \fIoptional_class\fR { notify\-delay \fIseconds\fR; notify\-to\-soa \fIboolean\fR; also\-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR ) - [ port \fIinteger\fR ]; ... - [ key \fIkeyname\fR ] ... }; - allow\-notify { \fIaddress_match_element\fR; ... }; + [ port \fIinteger\fR ]; \&.\&.\&. + [ key \fIkeyname\fR ] \&.\&.\&. }; + allow\-notify { \fIaddress_match_element\fR; \&.\&.\&. }; forward ( first | only ); forwarders [ port \fIinteger\fR ] { - ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; ... + ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&. }; max\-journal\-size \fIsize_no_default\fR; max\-transfer\-time\-in \fIinteger\fR; @@ -492,16 +549,20 @@ view \fIstring\fR \fIoptional_class\fR { zero\-no\-soa\-ttl \fIboolean\fR; zero\-no\-soa\-ttl\-cache \fIboolean\fR; dnssec\-secure\-to\-insecure \fIboolean\fR; - allow\-v6\-synthesis { \fIaddress_match_element\fR; ... }; // obsolete + allow\-v6\-synthesis { \fIaddress_match_element\fR; \&.\&.\&. }; // obsolete fetch\-glue \fIboolean\fR; // obsolete maintain\-ixfr\-base \fIboolean\fR; // obsolete max\-ixfr\-log\-size \fIsize\fR; // obsolete }; .fi +.if n \{\ .RE +.\} .SH "ZONE" .sp +.if n \{\ .RS 4 +.\} .nf zone \fIstring\fR \fIoptional_class\fR { type ( master | slave | stub | hint | redirect | @@ -510,7 +571,7 @@ zone \fIstring\fR \fIoptional_class\fR { masters [ port \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [port \fIinteger\fR] | - \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key \fIstring\fR ]; ... + \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key \fIstring\fR ]; \&.\&.\&. }; database \fIstring\fR; delegation\-only \fIboolean\fR; @@ -524,18 +585,18 @@ zone \fIstring\fR \fIoptional_class\fR { journal \fIquoted_string\fR; zero\-no\-soa\-ttl \fIboolean\fR; dnssec\-secure\-to\-insecure \fIboolean\fR; - allow\-query { \fIaddress_match_element\fR; ... }; - allow\-query\-on { \fIaddress_match_element\fR; ... }; - allow\-transfer { \fIaddress_match_element\fR; ... }; - allow\-update { \fIaddress_match_element\fR; ... }; - allow\-update\-forwarding { \fIaddress_match_element\fR; ... }; + allow\-query { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-query\-on { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-transfer { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-update { \fIaddress_match_element\fR; \&.\&.\&. }; + allow\-update\-forwarding { \fIaddress_match_element\fR; \&.\&.\&. }; update\-policy \fIlocal\fR | \fI { ( grant | deny ) \fR\fI\fIstring\fR\fR\fI ( name | subdomain | wildcard | self | selfsub | selfwild | krb5\-self | ms\-self | krb5\-subdomain | ms\-subdomain | tcp\-self | zonesub | 6to4\-self ) \fR\fI\fIstring\fR\fR\fI \fR\fI\fIrrtypelist\fR\fR\fI; - \fR\fI[...]\fR\fI + \fR\fI[\&.\&.\&.]\fR\fI }\fR; update\-check\-ksk \fIboolean\fR; dnssec\-dnskey\-kskonly \fIboolean\fR; @@ -546,12 +607,12 @@ zone \fIstring\fR \fIoptional_class\fR { notify\-delay \fIseconds\fR; notify\-to\-soa \fIboolean\fR; also\-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR ) - [ port \fIinteger\fR ]; ... - [ key \fIkeyname\fR ] ... }; - allow\-notify { \fIaddress_match_element\fR; ... }; + [ port \fIinteger\fR ]; \&.\&.\&. + [ key \fIkeyname\fR ] \&.\&.\&. }; + allow\-notify { \fIaddress_match_element\fR; \&.\&.\&. }; forward ( first | only ); forwarders [ port \fIinteger\fR ] { - ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; ... + ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&. }; max\-journal\-size \fIsize_no_default\fR; max\-transfer\-time\-in \fIinteger\fR; @@ -585,16 +646,22 @@ zone \fIstring\fR \fIoptional_class\fR { pubkey \fIinteger\fR \fIinteger\fR \fIinteger\fR \fIquoted_string\fR; // obsolete }; .fi +.if n \{\ .RE +.\} .SH "FILES" .PP -\fI/etc/named.conf\fR +/etc/named\&.conf .SH "SEE ALSO" .PP \fBnamed\fR(8), -\fBnamed\-checkconf\fR(8), +\fBnamed-checkconf\fR(8), \fBrndc\fR(8), -BIND 9 Administrator Reference Manual. +BIND 9 Administrator Reference Manual\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004\-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/named/named.conf.docbook b/contrib/bind9/bin/named/named.conf.docbook index 85d13db95..01cb62aaa 100644 --- a/contrib/bind9/bin/named/named.conf.docbook +++ b/contrib/bind9/bin/named/named.conf.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2014-01-08 + - January 08, 2014 + ISC + Internet Systems Consortium, Inc. @@ -45,18 +47,19 @@ 2011 2013 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") - + named.conf - - DESCRIPTION + DESCRIPTION + named.conf is the configuration file for named. Statements are enclosed @@ -73,39 +76,39 @@ Unix style: # to end of line - + + + ACL - - ACL - + acl string { address_match_element; ... }; - + - - KEY - + KEY + + key domain_name { algorithm string; secret string; }; - + + + MASTERS - - MASTERS - + masters string port integer { ( masters | ipv4_address port integer | ipv6_address port integer ) key string ; ... }; - + - - SERVER - + SERVER + + server ( ipv4_address/prefixlen | ipv6_address/prefixlen ) { bogus boolean; edns boolean; @@ -124,29 +127,29 @@ server ( ipv4_address/prefixlen support-ixfr boolean; // obsolete }; - + + + TRUSTED-KEYS - - TRUSTED-KEYS - + trusted-keys { - domain_name flags protocol algorithm key; ... + domain_name flags protocol algorithm key; ... }; - + - - MANAGED-KEYS - + MANAGED-KEYS + + managed-keys { - domain_name initial-key flags protocol algorithm key; ... + domain_name initial-key flags protocol algorithm key; ... }; - + + + CONTROLS - - CONTROLS - + controls { inet ( ipv4_address | ipv6_address | * ) port ( integer | * ) @@ -155,11 +158,11 @@ controls { unix unsupported; // not implemented }; - + - - LOGGING - + LOGGING + + logging { channel string { file log_file; @@ -174,11 +177,11 @@ logging { category string { string; ... }; }; - + + + LWRES - - LWRES - + lwres { listen-on port integer { ( ipv4_address | ipv6_address ) port integer ; ... @@ -188,11 +191,11 @@ lwres { ndots integer; }; - + - - OPTIONS - + OPTIONS + + options { avoid-v4-udp-ports { port; ... }; avoid-v6-udp-ports { port; ... }; @@ -232,7 +235,6 @@ options { transfers-per-ns integer; transfers-in integer; transfers-out integer; - use-ixfr boolean; version ( quoted_string | none ); allow-recursion { address_match_element; ... }; allow-recursion-on { address_match_element; ... }; @@ -392,13 +394,14 @@ options { serial-queries integer; // obsolete treat-cr-as-space boolean; // obsolete use-id-pool boolean; // obsolete + use-ixfr boolean; // obsolete }; - + + + VIEW - - VIEW - + view string optional_class { match-clients { address_match_element; ... }; match-destinations { address_match_element; ... }; @@ -559,11 +562,11 @@ view string optional_class max-ixfr-log-size size; // obsolete }; - + - - ZONE - + ZONE + + zone string optional_class { type ( master | slave | stub | hint | redirect | forward | delegation-only ); @@ -657,16 +660,16 @@ zone string optional_class pubkey integer integer integer quoted_string; // obsolete }; - + + + FILES - - FILES /etc/named.conf - + + + SEE ALSO - - SEE ALSO named8 , @@ -678,10 +681,6 @@ zone string optional_class , BIND 9 Administrator Reference Manual. - + - + diff --git a/contrib/bind9/bin/named/named.conf.html b/contrib/bind9/bin/named/named.conf.html index 0e1d2eb60..e21dd36c8 100644 --- a/contrib/bind9/bin/named/named.conf.html +++ b/contrib/bind9/bin/named/named.conf.html @@ -1,5 +1,5 @@ - named.conf - + -
    -
    +
    +

    Name

    named.conf — configuration file for named

    @@ -30,11 +29,11 @@

    Synopsis

    named.conf

    -
    -

    DESCRIPTION

    +
    +

    DESCRIPTION

    named.conf is the configuration file for - named. Statements are enclosed + named. Statements are enclosed in braces and terminated with a semi-colon. Clauses in the statements are also semi-colon terminated. The usual comment styles are supported: @@ -49,15 +48,15 @@ Unix style: # to end of line

    -
    -

    ACL

    +
    +

    ACL


    acl string { address_match_element; ... };

    -
    -

    KEY

    +
    +

    KEY


    key domain_name {
    algorithm string;
    @@ -65,8 +64,8 @@ key };

    -
    -

    MASTERS

    +
    +

    MASTERS


    masters string [ port integer ] {
    ( masters | ipv4_address [port integer] |
    @@ -74,8 +73,8 @@ masters };

    -
    -

    SERVER

    +
    +

    SERVER


    server ( ipv4_address[/prefixlen] | ipv6_address[/prefixlen] ) {
    bogus boolean;
    @@ -96,24 +95,24 @@ server };

    -
    -

    TRUSTED-KEYS

    +
    +

    TRUSTED-KEYS


    trusted-keys {
    - domain_name flags protocol algorithm key; ... 
    + domain_name flags protocol algorithm key; ...
    };

    -
    -

    MANAGED-KEYS

    +
    +

    MANAGED-KEYS


    managed-keys {
    - domain_name initial-key flags protocol algorithm key; ... 
    + domain_name initial-key flags protocol algorithm key; ...
    };

    -
    -

    CONTROLS

    +
    +

    CONTROLS


    controls {
    inet ( ipv4_address | ipv6_address | * )
    @@ -124,8 +123,8 @@ controls };

    -
    -

    LOGGING

    +
    +

    LOGGING


    logging {
    channel string {
    @@ -142,8 +141,8 @@ logging };

    -
    -

    LWRES

    +
    +

    LWRES


    lwres {
    listen-on [ port integer ] {
    @@ -155,8 +154,8 @@ lwres };

    -
    -

    OPTIONS

    +
    +

    OPTIONS


    options {
    avoid-v4-udp-ports { port; ... };
    @@ -197,7 +196,6 @@ options transfers-per-ns integer;
    transfers-in integer;
    transfers-out integer;
    - use-ixfr boolean;
    version ( quoted_string | none );
    allow-recursion { address_match_element; ... };
    allow-recursion-on { address_match_element; ... };
    @@ -258,9 +256,9 @@ options dns64-server string;
    dns64-contact string;
    dns64 prefix {
    - clients { <replacable>acl</replacable>; };
    - exclude { <replacable>acl</replacable>; };
    - mapped { <replacable>acl</replacable>; };
    + clients { <replacable>acl</replacable>; };
    + exclude { <replacable>acl</replacable>; };
    + mapped { <replacable>acl</replacable>; };
    break-dnssec boolean;
    recursive-only boolean;
    suffix ipv6_address;
    @@ -357,11 +355,12 @@ options serial-queries integer; // obsolete
    treat-cr-as-space boolean; // obsolete
    use-id-pool boolean; // obsolete
    + use-ixfr boolean; // obsolete
    };

    -
    -

    VIEW

    +
    +

    VIEW


    view string optional_class {
    match-clients { address_match_element; ... };
    @@ -445,9 +444,9 @@ view dns64-server string;
    dns64-contact string;
    dns64 prefix {
    - clients { <replacable>acl</replacable>; };
    - exclude { <replacable>acl</replacable>; };
    - mapped { <replacable>acl</replacable>; };
    + clients { <replacable>acl</replacable>; };
    + exclude { <replacable>acl</replacable>; };
    + mapped { <replacable>acl</replacable>; };
    break-dnssec boolean;
    recursive-only boolean;
    suffix ipv6_address;
    @@ -524,8 +523,8 @@ view };

    -
    -

    ZONE

    +
    +

    ZONE


    zone string optional_class {
    type ( master | slave | stub | hint | redirect |
    @@ -621,13 +620,13 @@ zone };

    -
    -

    FILES

    +
    +

    FILES

    /etc/named.conf

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    named(8), named-checkconf(8), rndc(8), diff --git a/contrib/bind9/bin/named/named.docbook b/contrib/bind9/bin/named/named.docbook index 0ea469d35..ff6c00f87 100644 --- a/contrib/bind9/bin/named/named.docbook +++ b/contrib/bind9/bin/named/named.docbook @@ -1,6 +1,3 @@ -]> - + + + + 2014-02-20 + - February 20, 2014 + ISC + Internet Systems Consortium, Inc. @@ -57,32 +59,32 @@ - + named - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + - - DESCRIPTION + DESCRIPTION + named is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more @@ -95,10 +97,10 @@ /etc/named.conf, read any initial data, and listen for queries. - + + + OPTIONS - - OPTIONS @@ -307,11 +309,14 @@ worker threads to listen for incoming UDP packets on each address. If not specified, named will calculate a default value based on the number of detected - CPUs: 1 for 1 CPU, 2 for 2-4 CPUs, and the number of - detected CPUs divided by 2 for values higher than 4. + CPUs: 1 for 1 CPU, and the number of detected CPUs + minus one for machines with more than 1 CPU. This cannot + be increased to a value higher than the number of CPUs. If has been set to a higher value than the number of detected CPUs, then may be increased as high as that value, but no higher. + On Windows, the number of UDP listeners is hardwired to 1 + and this option has no effect. @@ -379,10 +384,10 @@ - + + + SIGNALS - - SIGNALS In routine operation, signals should not be used to control the nameserver; rndc should be used @@ -415,10 +420,10 @@ The result of sending any other signals to the server is undefined. - + + + CONFIGURATION - - CONFIGURATION The named configuration file is too complex to describe in detail here. A complete description is provided @@ -435,10 +440,10 @@ named process. - + + + FILES - - FILES @@ -462,10 +467,10 @@ - + + + SEE ALSO - - SEE ALSO RFC 1033, RFC 1034, RFC 1035, @@ -491,16 +496,6 @@ , BIND 9 Administrator Reference Manual. - - - - AUTHOR - Internet Systems Consortium - - + - + diff --git a/contrib/bind9/bin/named/named.html b/contrib/bind9/bin/named/named.html index 83494ee5d..04a6b1953 100644 --- a/contrib/bind9/bin/named/named.html +++ b/contrib/bind9/bin/named/named.html @@ -14,14 +14,13 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - named - + -

    +

    Name

    @@ -31,24 +30,24 @@

    Synopsis

    named [-4] [-6] [-c config-file] [-d debug-level] [-E engine-name] [-f] [-g] [-M option] [-m flag] [-n #cpus] [-p port] [-s] [-S #max-socks] [-t directory] [-U #listeners] [-u user] [-v] [-V] [-x cache-file]

    -
    -

    DESCRIPTION

    -

    named +

    +

    DESCRIPTION

    +

    named is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more information on the DNS, see RFCs 1033, 1034, and 1035.

    - When invoked without arguments, named + When invoked without arguments, named will read the default configuration file /etc/named.conf, read any initial data, and listen for queries.

    -
    -

    OPTIONS

    -
    +
    +

    OPTIONS

    +
    -4

    Use IPv4 only even if the host machine is capable of IPv6. @@ -76,7 +75,7 @@

    -d debug-level

    Set the daemon's debug level to debug-level. - Debugging traces from named become + Debugging traces from named become more verbose as the debug level increases.

    -E engine-name
    @@ -119,7 +118,7 @@

    Create #cpus worker threads to take advantage of multiple CPUs. If not specified, - named will try to determine the + named will try to determine the number of CPUs present and create one thread per CPU. If it is unable to determine the number of CPUs, a single worker thread will be created. @@ -145,7 +144,7 @@

    -S #max-socks

    - Allow named to use up to + Allow named to use up to #max-socks sockets.

    @@ -162,7 +161,7 @@ specified number of sockets. Note also that the actual maximum number is normally a little fewer than the specified value because - named reserves some file descriptors + named reserves some file descriptors for its internal use.

    @@ -190,13 +189,16 @@

    Use #listeners worker threads to listen for incoming UDP packets on each - address. If not specified, named will + address. If not specified, named will calculate a default value based on the number of detected - CPUs: 1 for 1 CPU, 2 for 2-4 CPUs, and the number of - detected CPUs divided by 2 for values higher than 4. + CPUs: 1 for 1 CPU, and the number of detected CPUs + minus one for machines with more than 1 CPU. This cannot + be increased to a value higher than the number of CPUs. If -n has been set to a higher value than the number of detected CPUs, then -U may be increased as high as that value, but no higher. + On Windows, the number of UDP listeners is hardwired to 1 + and this option has no effect.

    -u user
    @@ -208,13 +210,13 @@

    Note

    - On Linux, named uses the kernel's + On Linux, named uses the kernel's capability mechanism to drop all root privileges except the ability to bind(2) to a privileged port and set process resource limits. Unfortunately, this means that the -u - option only works when named is + option only works when named is run on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or later, since previous kernels did not allow privileges @@ -247,14 +249,14 @@

    -
    -

    SIGNALS

    +
    +

    SIGNALS

    In routine operation, signals should not be used to control - the nameserver; rndc should be used + the nameserver; rndc should be used instead.

    -
    +
    SIGHUP

    Force a reload of the server. @@ -268,26 +270,26 @@ The result of sending any other signals to the server is undefined.

    -
    -

    CONFIGURATION

    +
    +

    CONFIGURATION

    - The named configuration file is too complex + The named configuration file is too complex to describe in detail here. A complete description is provided in the BIND 9 Administrator Reference Manual.

    - named inherits the umask + named inherits the umask (file creation mode mask) from the parent process. If files - created by named, such as journal files, + created by named, such as journal files, need to have custom permissions, the umask should be set explicitly in the script used to start the - named process. + named process.

    -
    -

    FILES

    -
    +
    +

    FILES

    +
    /etc/named.conf

    The default configuration file. @@ -298,8 +300,8 @@

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    RFC 1033, RFC 1034, RFC 1035, @@ -311,10 +313,5 @@ BIND 9 Administrator Reference Manual.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/named/query.c b/contrib/bind9/bin/named/query.c index 8df3c7145..d780671eb 100644 --- a/contrib/bind9/bin/named/query.c +++ b/contrib/bind9/bin/named/query.c @@ -26,6 +26,7 @@ #include #include #include +#include #include #include @@ -90,6 +91,9 @@ /*% Want Recursion? */ #define WANTRECURSION(c) (((c)->query.attributes & \ NS_QUERYATTR_WANTRECURSION) != 0) +/*% Is TCP? */ +#define TCP(c) (((c)->attributes & NS_CLIENTATTR_TCP) != 0) + /*% Want DNSSEC? */ #define WANTDNSSEC(c) (((c)->attributes & \ NS_CLIENTATTR_WANTDNSSEC) != 0) @@ -118,26 +122,37 @@ DNS_RDATASETATTR_NOQNAME) != 0) #ifdef WANT_QUERYTRACE -#define CTRACE(l,m) do { \ - if (client != NULL && client->query.qname != NULL) { \ - if (isc_log_wouldlog(ns_g_lctx, l)) { \ - char qbuf[DNS_NAME_FORMATSIZE]; \ - dns_name_format(client->query.qname, \ - qbuf, sizeof(qbuf)); \ - isc_log_write(ns_g_lctx, \ - NS_LOGCATEGORY_CLIENT, \ - NS_LOGMODULE_QUERY, \ - l, "client %p (%s): %s", \ - client, qbuf, (m)); \ - } \ - } else { \ - isc_log_write(ns_g_lctx, \ - NS_LOGCATEGORY_CLIENT, \ - NS_LOGMODULE_QUERY, \ - l, "client %p (): %s", \ - client, (m)); \ - } \ -} while(0) +static inline void +client_trace(ns_client_t *client, int level, const char *message) { + if (client != NULL && client->query.qname != NULL) { + if (isc_log_wouldlog(ns_g_lctx, level)) { + char qbuf[DNS_NAME_FORMATSIZE]; + char tbuf[DNS_RDATATYPE_FORMATSIZE]; + dns_name_format(client->query.qname, + qbuf, sizeof(qbuf)); + dns_rdatatype_format(client->query.qtype, + tbuf, sizeof(tbuf)); + isc_log_write(ns_g_lctx, + NS_LOGCATEGORY_CLIENT, + NS_LOGMODULE_QUERY, level, + "query client=%p thread=0x%lx " + "(%s/%s): %s", + client, + (unsigned long) isc_thread_self(), + qbuf, tbuf, message); + } + } else { + isc_log_write(ns_g_lctx, + NS_LOGCATEGORY_CLIENT, + NS_LOGMODULE_QUERY, level, + "query client=%p thread=0x%lx " + "(): %s", + client, + (unsigned long) isc_thread_self(), + message); + } +} +#define CTRACE(l,m) client_trace(client, l, m) #else #define CTRACE(l,m) ((void)m) #endif /* WANT_QUERYTRACE */ @@ -330,6 +345,8 @@ query_reset(ns_client_t *client, isc_boolean_t everything) { isc_buffer_t *dbuf, *dbuf_next; ns_dbversion_t *dbversion, *dbversion_next; + CTRACE(ISC_LOG_DEBUG(3), "query_reset"); + /*% * Reset the query state of a client to its default state. */ @@ -471,7 +488,7 @@ query_getnamebuf(ns_client_t *client) { dbuf = ISC_LIST_TAIL(client->query.namebufs); INSIST(dbuf != NULL); isc_buffer_availableregion(dbuf, &r); - if (r.length < 255) { + if (r.length < DNS_NAME_MAXWIRE) { result = query_newnamebuf(client); if (result != ISC_R_SUCCESS) { CTRACE(ISC_LOG_DEBUG(3), @@ -951,7 +968,7 @@ rpz_log_fail(ns_client_t *client, int level, */ dns_name_format(client->query.qname, namebuf1, sizeof(namebuf1)); dns_name_format(name, namebuf2, sizeof(namebuf2)); - ns_client_log(client, NS_LOGCATEGORY_QUERY_EERRORS, + ns_client_log(client, NS_LOGCATEGORY_QUERY_ERRORS, NS_LOGMODULE_QUERY, level, "rpz %s rewrite %s via %s %sfailed: %s", dns_rpz_type2str(rpz_type), @@ -3732,7 +3749,7 @@ query_resume(isc_task_t *task, isc_event_t *event) { ns_client_t *client; isc_boolean_t fetch_canceled, client_shuttingdown; isc_result_t result; - isc_logcategory_t *logcategory = NS_LOGCATEGORY_QUERY_EERRORS; + isc_logcategory_t *logcategory = NS_LOGCATEGORY_QUERY_ERRORS; int errorloglevel; /* @@ -4419,8 +4436,6 @@ rpz_find(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qnamef, policy = DNS_RPZ_POLICY_MISS; break; default: - dns_db_detach(dbp); - dns_zone_detach(zonep); rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, rpz_type, qnamef, "", result); CTRACE(ISC_LOG_ERROR, @@ -5668,6 +5683,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) isc_boolean_t associated; dns_section_t section; dns_ttl_t ttl; +#ifdef WANT_QUERYTRACE + char mbuf[BUFSIZ]; + char qbuf[DNS_NAME_FORMATSIZE]; +#endif CTRACE(ISC_LOG_DEBUG(3), "query_find"); @@ -5702,6 +5721,25 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) dns_clientinfomethods_init(&cm, ns_client_sourceip); dns_clientinfo_init(&ci, client); +#ifdef WANT_QUERYTRACE + if (client->query.origqname != NULL) + dns_name_format(client->query.origqname, qbuf, + sizeof(qbuf)); + else + snprintf(qbuf, sizeof(qbuf), ""); + + snprintf(mbuf, sizeof(mbuf) - 1, + "client attr:0x%x, query attr:0x%X, restarts:%d, " + "origqname:%s, timer:%d, authdb:%d, referral:%d", + client->attributes, + client->query.attributes, + client->query.restarts, qbuf, + (int) client->query.timerset, + (int) client->query.authdbset, + (int) client->query.isreferral); + CTRACE(ISC_LOG_DEBUG(3), mbuf); +#endif + if (event != NULL) { /* * We're returning from recursion. Restore the query context @@ -5711,7 +5749,33 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) rpz_st = client->query.rpz_st; if (rpz_st != NULL && - (rpz_st->state & DNS_RPZ_RECURSING) != 0) { + (rpz_st->state & DNS_RPZ_RECURSING) != 0) + { + CTRACE(ISC_LOG_DEBUG(3), "resume from RPZ recursion"); +#ifdef WANT_QUERYTRACE + { + char rbuf[DNS_NAME_FORMATSIZE] = ""; + char fbuf[DNS_NAME_FORMATSIZE] = ""; + if (rpz_st->qname != NULL) + dns_name_format(rpz_st->qname, + qbuf, sizeof(qbuf)); + else + snprintf(qbuf, sizeof(qbuf), + ""); + if (rpz_st->r_name != NULL) + dns_name_format(rpz_st->r_name, + rbuf, sizeof(rbuf)); + if (rpz_st->fname != NULL) + dns_name_format(rpz_st->fname, + fbuf, sizeof(fbuf)); + + snprintf(mbuf, sizeof(mbuf) - 1, + "rpz qname %s, rname:%s, fname:%s", + qbuf, rbuf, fbuf); + CTRACE(ISC_LOG_DEBUG(3), mbuf); + } +#endif + is_zone = rpz_st->q.is_zone; authoritative = rpz_st->q.authoritative; zone = rpz_st->q.zone; @@ -5741,6 +5805,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) rdataset = event->rdataset; sigrdataset = event->sigrdataset; } + INSIST(rdataset != NULL); if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig) type = dns_rdatatype_any; @@ -5846,11 +5911,14 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) options |= DNS_GETDB_NOEXACT; result = query_getdb(client, client->query.qname, qtype, options, &zone, &db, &version, &is_zone); - if ((result != ISC_R_SUCCESS || !is_zone) && !RECURSIONOK(client) && - (options & DNS_GETDB_NOEXACT) != 0 && qtype == dns_rdatatype_ds) { + if (ISC_UNLIKELY((result != ISC_R_SUCCESS || !is_zone) && + qtype == dns_rdatatype_ds && + !RECURSIONOK(client) && + (options & DNS_GETDB_NOEXACT) != 0)) + { /* - * Look to see if we are authoritative for the - * child zone if the query type is DS. + * If the query type is DS, look to see if we are + * authoritative for the child zone. */ dns_db_t *tdb = NULL; dns_zone_t *tzone = NULL; @@ -5923,7 +5991,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) * We'll need some resources... */ dbuf = query_getnamebuf(client); - if (dbuf == NULL) { + if (ISC_UNLIKELY(dbuf == NULL)) { CTRACE(ISC_LOG_ERROR, "query_find: query_getnamebuf failed (2)"); QUERY_ERROR(DNS_R_SERVFAIL); @@ -5931,7 +5999,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) } fname = query_newname(client, dbuf, &b); rdataset = query_newrdataset(client); - if (fname == NULL || rdataset == NULL) { + if (ISC_UNLIKELY(fname == NULL || rdataset == NULL)) { CTRACE(ISC_LOG_ERROR, "query_find: query_newname failed (2)"); QUERY_ERROR(DNS_R_SERVFAIL); @@ -6072,7 +6140,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) inc_stats(client, dns_nsstatscounter_rateslipped); client->message->flags |= - DNS_MESSAGEFLAG_TC; + DNS_MESSAGEFLAG_TC; if (resp_result == DNS_R_NXDOMAIN) client->message->rcode = dns_rcode_nxdomain; @@ -7737,7 +7805,7 @@ log_queryerror(ns_client_t *client, isc_result_t result, int line, int level) { } } - ns_client_log(client, NS_LOGCATEGORY_QUERY_EERRORS, NS_LOGMODULE_QUERY, + ns_client_log(client, NS_LOGCATEGORY_QUERY_ERRORS, NS_LOGMODULE_QUERY, level, "query failed (%s)%s%s%s%s%s%s at %s:%d", isc_result_totext(result), sep1, namep, sep2, classp, sep2, typep, __FILE__, line); @@ -7758,8 +7826,16 @@ ns_query_start(ns_client_t *client) { /* * Test only. */ - if (ns_g_clienttest && (client->attributes & NS_CLIENTATTR_TCP) == 0) - RUNTIME_CHECK(ns_client_replace(client) == ISC_R_SUCCESS); + if (ns_g_clienttest && !TCP(client)) { + result = ns_client_replace(client); + if (result == ISC_R_SHUTTINGDOWN) { + ns_client_next(client, result); + return; + } else if (result != ISC_R_SUCCESS) { + query_error(client, result, __LINE__); + return; + } + } /* * Ensure that appropriate cleanups occur. @@ -7805,6 +7881,14 @@ ns_query_start(ns_client_t *client) { client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK; } + /* + * Check for multiple question queries, since edns1 is dead. + */ + if (message->counts[DNS_SECTION_QUESTION] > 1) { + query_error(client, DNS_R_FORMERR, __LINE__); + return; + } + /* * Get the question name. */ @@ -7832,20 +7916,12 @@ ns_query_start(ns_client_t *client) { if (ns_g_server->log_queries) log_query(client, saved_flags, saved_extflags); - /* - * Check for multiple question queries, since edns1 is dead. - */ - if (message->counts[DNS_SECTION_QUESTION] > 1) { - query_error(client, DNS_R_FORMERR, __LINE__); - return; - } - /* * Check for meta-queries like IXFR and AXFR. */ rdataset = ISC_LIST_HEAD(client->query.qname->list); INSIST(rdataset != NULL); - qtype = rdataset->type; + client->query.qtype = qtype = rdataset->type; dns_rdatatypestats_increment(ns_g_server->rcvquerystats, qtype); if (dns_rdatatype_ismeta(qtype)) { diff --git a/contrib/bind9/bin/named/server.c b/contrib/bind9/bin/named/server.c index d7d1a59fc..e6a1651f2 100644 --- a/contrib/bind9/bin/named/server.c +++ b/contrib/bind9/bin/named/server.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -188,6 +188,7 @@ struct ns_cache { dns_view_t *primaryview; isc_boolean_t needflush; isc_boolean_t adbsizeadjusted; + dns_rdataclass_t rdclass; ISC_LINK(ns_cache_t) link; }; @@ -1388,13 +1389,16 @@ setquerystats(dns_zone_t *zone, isc_mem_t *mctx, dns_zonestat_level_t level) { } static ns_cache_t * -cachelist_find(ns_cachelist_t *cachelist, const char *cachename) { +cachelist_find(ns_cachelist_t *cachelist, const char *cachename, + dns_rdataclass_t rdclass) +{ ns_cache_t *nsc; for (nsc = ISC_LIST_HEAD(*cachelist); nsc != NULL; nsc = ISC_LIST_NEXT(nsc, link)) { - if (strcmp(dns_cache_getname(nsc->cache), cachename) == 0) + if (nsc->rdclass == rdclass && + strcmp(dns_cache_getname(nsc->cache), cachename) == 0) return (nsc); } @@ -1405,7 +1409,8 @@ static isc_boolean_t cache_reusable(dns_view_t *originview, dns_view_t *view, isc_boolean_t new_zero_no_soattl) { - if (originview->checknames != view->checknames || + if (originview->rdclass != view->rdclass || + originview->checknames != view->checknames || dns_resolver_getzeronosoattl(originview->resolver) != new_zero_no_soattl || originview->acceptexpired != view->acceptexpired || @@ -2595,7 +2600,7 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, else cachename = view->name; cache = NULL; - nsc = cachelist_find(cachelist, cachename); + nsc = cachelist_find(cachelist, cachename, view->rdclass); if (nsc != NULL) { if (!cache_sharable(nsc->primaryview, view, zero_no_soattl, cleaning_interval, max_cache_size)) { @@ -2677,6 +2682,7 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, nsc->primaryview = view; nsc->needflush = ISC_FALSE; nsc->adbsizeadjusted = ISC_FALSE; + nsc->rdclass = view->rdclass; ISC_LINK_INIT(nsc, link); ISC_LIST_APPEND(*cachelist, nsc, link); } @@ -3760,8 +3766,15 @@ get_viewinfo(const cfg_obj_t *vconfig, const char **namep, viewname = cfg_obj_asstring(cfg_tuple_get(vconfig, "name")); classobj = cfg_tuple_get(vconfig, "class"); - result = ns_config_getclass(classobj, dns_rdataclass_in, - &viewclass); + CHECK(ns_config_getclass(classobj, dns_rdataclass_in, + &viewclass)); + if (dns_rdataclass_ismeta(viewclass)) { + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, ISC_LOG_ERROR, + "view '%s': class must not be meta", + viewname); + CHECK(ISC_R_FAILURE); + } } else { viewname = "_default"; viewclass = dns_rdataclass_in; @@ -3770,6 +3783,7 @@ get_viewinfo(const cfg_obj_t *vconfig, const char **namep, *namep = viewname; *classp = viewclass; +cleanup: return (result); } @@ -6603,28 +6617,61 @@ ns_server_reloadwanted(ns_server_t *server) { } static char * -next_token(char **stringp, const char *delim) { - char *res; +next_token(isc_lex_t *lex, isc_buffer_t *text) { + isc_result_t result; + isc_token_t token; - do { - res = strsep(stringp, delim); - if (res == NULL) - break; - } while (*res == '\0'); - return (res); + token.type = isc_tokentype_unknown; + result = isc_lex_gettoken(lex, ISC_LEXOPT_EOF|ISC_LEXOPT_QSTRING, + &token); + + switch (result) { + case ISC_R_NOMORE: + (void) isc_lex_close(lex); + break; + case ISC_R_SUCCESS: + if (token.type == isc_tokentype_eof) + (void) isc_lex_close(lex); + break; + case ISC_R_NOSPACE: + if (text != NULL) { + (void) putstr(text, "token too large"); + (void) putnull(text); + } + return (NULL); + default: + if (text != NULL) { + (void) putstr(text, isc_result_totext(result)); + (void) putnull(text); + } + return (NULL); + } + + if (token.type == isc_tokentype_string || + token.type == isc_tokentype_qstring) + return (token.value.as_textregion.base); + + return (NULL); } /* - * Find the zone specified in the control channel command 'args', - * if any. If a zone is specified, point '*zonep' at it, otherwise - * set '*zonep' to NULL. + * Find the zone specified in the control channel command, if any. + * If a zone is specified, point '*zonep' at it, otherwise + * set '*zonep' to NULL, and f 'zonename' is not NULL, copy + * the zone name into it (N.B. 'zonename' must have space to hold + * a full DNS name). + * + * If 'zonetxt' is set, the caller has already pulled a token + * off the command line that is to be used as the zone name. (This + * is sometimes done when it's necessary to check for an optional + * argument before the zone name, as in "rndc sync [-clean] zone".) */ static isc_result_t -zone_from_args(ns_server_t *server, char *args, const char *zonetxt, - dns_zone_t **zonep, const char **zonename, +zone_from_args(ns_server_t *server, isc_lex_t *lex, const char *zonetxt, + dns_zone_t **zonep, char *zonename, isc_buffer_t *text, isc_boolean_t skip) { - char *input, *ptr; + char *ptr; char *classtxt; const char *viewtxt = NULL; dns_fixedname_t fname; @@ -6633,43 +6680,42 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt, dns_view_t *view = NULL; dns_rdataclass_t rdclass; char problem[DNS_NAME_FORMATSIZE + 500] = ""; + char zonebuf[DNS_NAME_FORMATSIZE]; REQUIRE(zonep != NULL && *zonep == NULL); - REQUIRE(zonename == NULL || *zonename == NULL); - - input = args; if (skip) { /* Skip the command name. */ - ptr = next_token(&input, " \t"); + ptr = next_token(lex, text); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); } /* Look for the zone name. */ if (zonetxt == NULL) - zonetxt = next_token(&input, " \t"); + zonetxt = next_token(lex, text); if (zonetxt == NULL) return (ISC_R_SUCCESS); - if (zonename != NULL) - *zonename = zonetxt; - /* Look for the optional class name. */ - classtxt = next_token(&input, " \t"); - if (classtxt != NULL) { - /* Look for the optional view name. */ - viewtxt = next_token(&input, " \t"); - } + /* Copy zonetxt because it'll be overwritten by next_token() */ + strlcpy(zonebuf, zonetxt, DNS_NAME_FORMATSIZE); + if (zonename != NULL) + strlcpy(zonename, zonetxt, DNS_NAME_FORMATSIZE); dns_fixedname_init(&fname); name = dns_fixedname_name(&fname); - CHECK(dns_name_fromstring(name, zonetxt, 0, NULL)); + CHECK(dns_name_fromstring(name, zonebuf, 0, NULL)); + /* Look for the optional class name. */ + classtxt = next_token(lex, text); if (classtxt != NULL) { isc_textregion_t r; r.base = classtxt; r.length = strlen(classtxt); CHECK(dns_rdataclass_fromtext(&rdclass, &r)); + + /* Look for the optional view name. */ + viewtxt = next_token(lex, text); } else rdclass = dns_rdataclass_in; @@ -6680,11 +6726,11 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt, if (result == ISC_R_NOTFOUND) snprintf(problem, sizeof(problem), "no matching zone '%s' in any view", - zonetxt); + zonebuf); else if (result == ISC_R_MULTIPLE) snprintf(problem, sizeof(problem), "zone '%s' was found in multiple views", - zonetxt); + zonebuf); } else { result = dns_viewlist_find(&server->viewlist, viewtxt, rdclass, &view); @@ -6698,7 +6744,7 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt, if (result != ISC_R_SUCCESS) snprintf(problem, sizeof(problem), "no matching zone '%s' in view '%s'", - zonetxt, viewtxt); + zonebuf, viewtxt); } /* Partial match? */ @@ -6726,7 +6772,7 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt, * Act on a "retransfer" command from the command channel. */ isc_result_t -ns_server_retransfercommand(ns_server_t *server, char *args, +ns_server_retransfercommand(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text) { isc_result_t result; @@ -6734,7 +6780,7 @@ ns_server_retransfercommand(ns_server_t *server, char *args, dns_zone_t *raw = NULL; dns_zonetype_t type; - result = zone_from_args(server, args, NULL, &zone, NULL, + result = zone_from_args(server, lex, NULL, &zone, NULL, text, ISC_TRUE); if (result != ISC_R_SUCCESS) return (result); @@ -6759,13 +6805,15 @@ ns_server_retransfercommand(ns_server_t *server, char *args, * Act on a "reload" command from the command channel. */ isc_result_t -ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) { +ns_server_reloadcommand(ns_server_t *server, isc_lex_t *lex, + isc_buffer_t *text) +{ isc_result_t result; dns_zone_t *zone = NULL; dns_zonetype_t type; const char *msg = NULL; - result = zone_from_args(server, args, NULL, &zone, NULL, + result = zone_from_args(server, lex, NULL, &zone, NULL, text, ISC_TRUE); if (result != ISC_R_SUCCESS) return (result); @@ -6833,12 +6881,14 @@ cleanup: * Act on a "notify" command from the command channel. */ isc_result_t -ns_server_notifycommand(ns_server_t *server, char *args, isc_buffer_t *text) { +ns_server_notifycommand(ns_server_t *server, isc_lex_t *lex, + isc_buffer_t *text) +{ isc_result_t result; dns_zone_t *zone = NULL; const unsigned char msg[] = "zone notify queued"; - result = zone_from_args(server, args, NULL, &zone, NULL, + result = zone_from_args(server, lex, NULL, &zone, NULL, text, ISC_TRUE); if (result != ISC_R_SUCCESS) return (result); @@ -6857,14 +6907,16 @@ ns_server_notifycommand(ns_server_t *server, char *args, isc_buffer_t *text) { * Act on a "refresh" command from the command channel. */ isc_result_t -ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t *text) { +ns_server_refreshcommand(ns_server_t *server, isc_lex_t *lex, + isc_buffer_t *text) +{ isc_result_t result; dns_zone_t *zone = NULL, *raw = NULL; const unsigned char msg1[] = "zone refresh queued"; const unsigned char msg2[] = "not a slave or stub zone"; dns_zonetype_t type; - result = zone_from_args(server, args, NULL, &zone, NULL, + result = zone_from_args(server, lex, NULL, &zone, NULL, text, ISC_TRUE); if (result != ISC_R_SUCCESS) return (result); @@ -6894,16 +6946,16 @@ ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t *text) { } isc_result_t -ns_server_togglequerylog(ns_server_t *server, char *args) { +ns_server_togglequerylog(ns_server_t *server, isc_lex_t *lex) { isc_boolean_t value; char *ptr; /* Skip the command name. */ - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); if (ptr == NULL) value = server->log_queries ? ISC_FALSE : ISC_TRUE; else if (strcasecmp(ptr, "yes") == 0 || strcasecmp(ptr, "on") == 0) @@ -7239,7 +7291,7 @@ dumpdone(void *arg, isc_result_t result) { } isc_result_t -ns_server_dumpdb(ns_server_t *server, char *args) { +ns_server_dumpdb(ns_server_t *server, isc_lex_t *lex) { struct dumpcontext *dctx = NULL; dns_view_t *view; isc_result_t result; @@ -7247,7 +7299,7 @@ ns_server_dumpdb(ns_server_t *server, char *args) { const char *sep; /* Skip the command name. */ - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); @@ -7275,37 +7327,37 @@ ns_server_dumpdb(ns_server_t *server, char *args) { CHECKMF(isc_stdio_open(server->dumpfile, "w", &dctx->fp), "could not open dump file", server->dumpfile); - sep = (args == NULL) ? "" : ": "; + ptr = next_token(lex, NULL); + sep = (ptr == NULL) ? "" : ": "; isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_INFO, - "dumpdb started%s%s", sep, (args != NULL) ? args : ""); + "dumpdb started%s%s", sep, (ptr != NULL) ? ptr : ""); - ptr = next_token(&args, " \t"); if (ptr != NULL && strcmp(ptr, "-all") == 0) { /* also dump zones */ dctx->dumpzones = ISC_TRUE; - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); } else if (ptr != NULL && strcmp(ptr, "-cache") == 0) { /* this is the default */ - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); } else if (ptr != NULL && strcmp(ptr, "-zones") == 0) { /* only dump zones, suppress caches */ dctx->dumpadb = ISC_FALSE; dctx->dumpbad = ISC_FALSE; dctx->dumpcache = ISC_FALSE; dctx->dumpzones = ISC_TRUE; - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); #ifdef ENABLE_FETCHLIMIT } else if (ptr != NULL && strcmp(ptr, "-adb") == 0) { /* only dump adb, suppress other caches */ dctx->dumpbad = ISC_FALSE; dctx->dumpcache = ISC_FALSE; - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); } else if (ptr != NULL && strcmp(ptr, "-bad") == 0) { /* only dump badcache, suppress other caches */ dctx->dumpadb = ISC_FALSE; dctx->dumpcache = ISC_FALSE; - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); #endif /* ENABLE_FETCHLIMIT */ } @@ -7319,7 +7371,7 @@ ns_server_dumpdb(ns_server_t *server, char *args) { CHECK(add_view_tolist(dctx, view)); } if (ptr != NULL) { - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); if (ptr != NULL) goto nextview; } @@ -7333,7 +7385,7 @@ ns_server_dumpdb(ns_server_t *server, char *args) { } isc_result_t -ns_server_dumpsecroots(ns_server_t *server, char *args) { +ns_server_dumpsecroots(ns_server_t *server, isc_lex_t *lex) { dns_view_t *view; dns_keytable_t *secroots = NULL; isc_result_t result; @@ -7343,11 +7395,11 @@ ns_server_dumpsecroots(ns_server_t *server, char *args) { char tbuf[64]; /* Skip the command name. */ - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); CHECKMF(isc_stdio_open(server->secrootsfile, "w", &fp), "could not open secroots dump file", server->secrootsfile); @@ -7376,7 +7428,7 @@ ns_server_dumpsecroots(ns_server_t *server, char *args) { isc_result_totext(result)); } if (ptr != NULL) - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); } while (ptr != NULL); cleanup: @@ -7438,26 +7490,25 @@ ns_server_dumprecursing(ns_server_t *server) { } isc_result_t -ns_server_setdebuglevel(ns_server_t *server, char *args) { +ns_server_setdebuglevel(ns_server_t *server, isc_lex_t *lex) { char *ptr; - char *levelstr; char *endp; long newlevel; UNUSED(server); /* Skip the command name. */ - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); /* Look for the new level name. */ - levelstr = next_token(&args, " \t"); - if (levelstr == NULL) { + ptr = next_token(lex, NULL); + if (ptr == NULL) { if (ns_g_debuglevel < 99) ns_g_debuglevel++; } else { - newlevel = strtol(levelstr, &endp, 10); + newlevel = strtol(ptr, &endp, 10); if (*endp != '\0' || newlevel < 0 || newlevel > 99) return (ISC_R_RANGE); ns_g_debuglevel = (unsigned int)newlevel; @@ -7470,20 +7521,20 @@ ns_server_setdebuglevel(ns_server_t *server, char *args) { } isc_result_t -ns_server_validation(ns_server_t *server, char *args) { - char *ptr, *viewname; +ns_server_validation(ns_server_t *server, isc_lex_t *lex) { + char *ptr; dns_view_t *view; isc_boolean_t changed = ISC_FALSE; isc_result_t result; isc_boolean_t enable; /* Skip the command name. */ - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); /* Find out what we are to do. */ - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); @@ -7497,7 +7548,7 @@ ns_server_validation(ns_server_t *server, char *args) { return (DNS_R_SYNTAX); /* Look for the view name. */ - viewname = next_token(&args, " \t"); + ptr = next_token(lex, NULL); result = isc_task_beginexclusive(server->task); RUNTIME_CHECK(result == ISC_R_SUCCESS); @@ -7505,7 +7556,7 @@ ns_server_validation(ns_server_t *server, char *args) { view != NULL; view = ISC_LIST_NEXT(view, link)) { - if (viewname != NULL && strcasecmp(viewname, view->name) != 0) + if (ptr != NULL && strcasecmp(ptr, view->name) != 0) continue; result = dns_view_flushcache(view); if (result != ISC_R_SUCCESS) @@ -7523,8 +7574,8 @@ ns_server_validation(ns_server_t *server, char *args) { } isc_result_t -ns_server_flushcache(ns_server_t *server, char *args) { - char *ptr, *viewname; +ns_server_flushcache(ns_server_t *server, isc_lex_t *lex) { + char *ptr; dns_view_t *view; isc_boolean_t flushed; isc_boolean_t found; @@ -7532,12 +7583,12 @@ ns_server_flushcache(ns_server_t *server, char *args) { ns_cache_t *nsc; /* Skip the command name. */ - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); /* Look for the view name. */ - viewname = next_token(&args, " \t"); + ptr = next_token(lex, NULL); result = isc_task_beginexclusive(server->task); RUNTIME_CHECK(result == ISC_R_SUCCESS); @@ -7550,7 +7601,7 @@ ns_server_flushcache(ns_server_t *server, char *args) { * list, flush these caches, and then update other views that refer to * the flushed cache DB. */ - if (viewname != NULL) { + if (ptr != NULL) { /* * Mark caches that need to be flushed. This is an O(#view^2) * operation in the very worst case, but should be normally @@ -7561,7 +7612,7 @@ ns_server_flushcache(ns_server_t *server, char *args) { view != NULL; view = ISC_LIST_NEXT(view, link)) { - if (strcasecmp(viewname, view->name) != 0) + if (strcasecmp(ptr, view->name) != 0) continue; found = ISC_TRUE; for (nsc = ISC_LIST_HEAD(server->cachelist); @@ -7580,7 +7631,7 @@ ns_server_flushcache(ns_server_t *server, char *args) { for (nsc = ISC_LIST_HEAD(server->cachelist); nsc != NULL; nsc = ISC_LIST_NEXT(nsc, link)) { - if (viewname != NULL && !nsc->needflush) + if (ptr != NULL && !nsc->needflush) continue; nsc->needflush = ISC_TRUE; result = dns_view_flushcache2(nsc->primaryview, ISC_FALSE); @@ -7634,11 +7685,11 @@ ns_server_flushcache(ns_server_t *server, char *args) { } if (flushed && found) { - if (viewname != NULL) + if (ptr != NULL) isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_INFO, "flushing cache in view '%s' succeeded", - viewname); + ptr); else isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_INFO, @@ -7649,7 +7700,7 @@ ns_server_flushcache(ns_server_t *server, char *args) { isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_ERROR, "flushing cache in view '%s' failed: " - "view not found", viewname); + "view not found", ptr); result = ISC_R_NOTFOUND; } else result = ISC_R_FAILURE; @@ -7659,8 +7710,9 @@ ns_server_flushcache(ns_server_t *server, char *args) { } isc_result_t -ns_server_flushnode(ns_server_t *server, char *args, isc_boolean_t tree) { - char *ptr, *target, *viewname; +ns_server_flushnode(ns_server_t *server, isc_lex_t *lex, isc_boolean_t tree) { + char *ptr, *viewname; + char target[DNS_NAME_FORMATSIZE]; dns_view_t *view; isc_boolean_t flushed; isc_boolean_t found; @@ -7670,15 +7722,16 @@ ns_server_flushnode(ns_server_t *server, char *args, isc_boolean_t tree) { dns_name_t *name; /* Skip the command name. */ - ptr = next_token(&args, " \t"); + ptr = next_token(lex, NULL); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); /* Find the domain name to flush. */ - target = next_token(&args, " \t"); - if (target == NULL) + ptr = next_token(lex, NULL); + if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); + strlcpy(target, ptr, DNS_NAME_FORMATSIZE); isc_buffer_constinit(&b, target, strlen(target)); isc_buffer_add(&b, strlen(target)); dns_fixedname_init(&fixed); @@ -7688,7 +7741,7 @@ ns_server_flushnode(ns_server_t *server, char *args, isc_boolean_t tree) { return (result); /* Look for the view name. */ - viewname = next_token(&args, " \t"); + viewname = next_token(lex, NULL); result = isc_task_beginexclusive(server->task); RUNTIME_CHECK(result == ISC_R_SUCCESS); @@ -7868,19 +7921,22 @@ delete_keynames(dns_tsig_keyring_t *ring, char *target, } isc_result_t -ns_server_tsigdelete(ns_server_t *server, char *command, isc_buffer_t *text) { +ns_server_tsigdelete(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text) { isc_result_t result; unsigned int n; dns_view_t *view; unsigned int foundkeys = 0; - char *target; - char *viewname; + char *ptr, *viewname; + char target[DNS_NAME_FORMATSIZE]; + + (void)next_token(lex, text); /* skip command name */ - (void)next_token(&command, " \t"); /* skip command name */ - target = next_token(&command, " \t"); - if (target == NULL) + ptr = next_token(lex, text); + if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); - viewname = next_token(&command, " \t"); + strlcpy(target, ptr, DNS_NAME_FORMATSIZE); + + viewname = next_token(lex, text); result = isc_task_beginexclusive(server->task); RUNTIME_CHECK(result == ISC_R_SUCCESS); @@ -8039,18 +8095,23 @@ ns_server_tsiglist(ns_server_t *server, isc_buffer_t *text) { * Act on a "sign" or "loadkeys" command from the command channel. */ isc_result_t -ns_server_rekey(ns_server_t *server, char *args, isc_buffer_t *text) { +ns_server_rekey(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text) { isc_result_t result; dns_zone_t *zone = NULL; dns_zonetype_t type; isc_uint16_t keyopts; isc_boolean_t fullsign = ISC_FALSE; + char *ptr; - if (strncasecmp(args, NS_COMMAND_SIGN, strlen(NS_COMMAND_SIGN)) == 0) - fullsign = ISC_TRUE; + ptr = next_token(lex, text); + if (ptr == NULL) + return (ISC_R_UNEXPECTEDEND); - result = zone_from_args(server, args, NULL, &zone, NULL, - text, ISC_TRUE); + if (strcasecmp(ptr, NS_COMMAND_SIGN) == 0) + fullsign = ISC_TRUE; + + result = zone_from_args(server, lex, NULL, &zone, NULL, + text, ISC_FALSE); if (result != ISC_R_SUCCESS) return (result); if (zone == NULL) @@ -8105,7 +8166,7 @@ synczone(dns_zone_t *zone, void *uap) { } isc_result_t -ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text) { +ns_server_sync(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text) { isc_result_t result, tresult; dns_view_t *view; dns_zone_t *zone = NULL; @@ -8114,16 +8175,16 @@ ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text) { const char *vname, *sep, *msg = NULL, *arg; isc_boolean_t cleanup = ISC_FALSE; - (void) next_token(&args, " \t"); + (void) next_token(lex, text); - arg = next_token(&args, " \t"); + arg = next_token(lex, text); if (arg != NULL && (strcmp(arg, "-clean") == 0 || strcmp(arg, "-clear") == 0)) { cleanup = ISC_TRUE; - arg = next_token(&args, " \t"); + arg = next_token(lex, text); } - result = zone_from_args(server, args, arg, &zone, NULL, + result = zone_from_args(server, lex, arg, &zone, NULL, text, ISC_FALSE); if (result != ISC_R_SUCCESS) return (result); @@ -8187,8 +8248,8 @@ ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text) { * Act on a "freeze" or "thaw" command from the command channel. */ isc_result_t -ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args, - isc_buffer_t *text) +ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, + isc_lex_t *lex, isc_buffer_t *text) { isc_result_t result, tresult; dns_zone_t *zone = NULL, *raw = NULL; @@ -8200,7 +8261,7 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args, isc_boolean_t frozen; const char *msg = NULL; - result = zone_from_args(server, args, NULL, &zone, NULL, + result = zone_from_args(server, lex, NULL, &zone, NULL, text, ISC_TRUE); if (result != ISC_R_SUCCESS) return (result); @@ -8388,7 +8449,7 @@ ns_server_add_zone(ns_server_t *server, char *args, isc_buffer_t *text) { dns_fixedname_init(&fname); dnsname = dns_fixedname_name(&fname); - CHECK(dns_name_fromtext(dnsname, &buf, dns_rootname, ISC_FALSE, NULL)); + CHECK(dns_name_fromtext(dnsname, &buf, dns_rootname, 0, NULL)); /* Make sense of optional class argument */ obj = cfg_tuple_get(parms, "class"); @@ -8562,21 +8623,21 @@ ns_server_add_zone(ns_server_t *server, char *args, isc_buffer_t *text) { * Act on a "delzone" command from the command channel. */ isc_result_t -ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text) { - isc_result_t result; +ns_server_del_zone(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text) { + isc_result_t result, tresult; dns_zone_t *zone = NULL; dns_view_t *view = NULL; dns_db_t *dbp = NULL; const char *filename = NULL; char *tmpname = NULL; char buf[1024]; - const char *zonename = NULL; + char zonename[DNS_NAME_FORMATSIZE]; size_t znamelen = 0; FILE *ifp = NULL, *ofp = NULL; isc_boolean_t inheader = ISC_TRUE; /* Parse parameters */ - CHECK(zone_from_args(server, args, NULL, &zone, &zonename, + CHECK(zone_from_args(server, lex, NULL, &zone, zonename, text, ISC_TRUE)); if (zone == NULL) { @@ -8593,7 +8654,16 @@ ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text) { goto cleanup; } - INSIST(zonename != NULL); + /* Is this a policy zone? */ + if (dns_zone_get_rpz(zone)) { + TCHECK(putstr(text, "zone '")); + TCHECK(putstr(text, zonename)); + TCHECK(putstr(text, + "' cannot be deleted: response-policy zone.")); + result = ISC_R_FAILURE; + goto cleanup; + } + znamelen = strlen(zonename); /* Dig out configuration for this zone */ @@ -8774,7 +8844,7 @@ newzone_cfgctx_destroy(void **cfgp) { } isc_result_t -ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) { +ns_server_signing(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text) { isc_result_t result = ISC_R_SUCCESS; dns_zone_t *zone = NULL; dns_name_t *origin; @@ -8795,43 +8865,51 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) { dns_rdataset_init(&privset); /* Skip the command name. */ - ptr = next_token(&args, " \t"); + ptr = next_token(lex, text); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); /* Find out what we are to do. */ - ptr = next_token(&args, " \t"); + ptr = next_token(lex, text); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); if (strcasecmp(ptr, "-list") == 0) list = ISC_TRUE; else if ((strcasecmp(ptr, "-clear") == 0) || - (strcasecmp(ptr, "-clean") == 0)) { + (strcasecmp(ptr, "-clean") == 0)) + { clear = ISC_TRUE; - ptr = next_token(&args, " \t"); + ptr = next_token(lex, text); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); strlcpy(keystr, ptr, sizeof(keystr)); } else if (strcasecmp(ptr, "-nsec3param") == 0) { - const char *hashstr, *flagstr, *iterstr; - char nbuf[512]; + char hashbuf[64], flagbuf[64], iterbuf[64]; + char nbuf[256]; chain = ISC_TRUE; - hashstr = next_token(&args, " \t"); - if (hashstr == NULL) + ptr = next_token(lex, text); + if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); - if (strcasecmp(hashstr, "none") == 0) + if (strcasecmp(ptr, "none") == 0) hash = 0; else { - flagstr = next_token(&args, " \t"); - iterstr = next_token(&args, " \t"); - if (flagstr == NULL || iterstr == NULL) + strlcpy(hashbuf, ptr, sizeof(hashbuf)); + + ptr = next_token(lex, text); + if (ptr == NULL) + return (ISC_R_UNEXPECTEDEND); + strlcpy(flagbuf, ptr, sizeof(flagbuf)); + + ptr = next_token(lex, text); + if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); + strlcpy(iterbuf, ptr, sizeof(iterbuf)); n = snprintf(nbuf, sizeof(nbuf), "%s %s %s", - hashstr, flagstr, iterstr); + hashbuf, flagbuf, iterbuf); if (n == sizeof(nbuf)) return (ISC_R_NOSPACE); n = sscanf(nbuf, "%hu %hu %hu", &hash, &flags, &iter); @@ -8841,7 +8919,7 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) { if (hash > 0xffU || flags > 0xffU) return (ISC_R_RANGE); - ptr = next_token(&args, " \t"); + ptr = next_token(lex, text); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); if (strcmp(ptr, "-") != 0) { @@ -8855,7 +8933,7 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) { } else CHECK(DNS_R_SYNTAX); - CHECK(zone_from_args(server, args, NULL, &zone, NULL, + CHECK(zone_from_args(server, lex, NULL, &zone, NULL, text, ISC_FALSE)); if (zone == NULL) CHECK(ISC_R_UNEXPECTEDEND); diff --git a/contrib/bind9/bin/named/statschannel.c b/contrib/bind9/bin/named/statschannel.c index 4bfd52176..06eb43224 100644 --- a/contrib/bind9/bin/named/statschannel.c +++ b/contrib/bind9/bin/named/statschannel.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2008-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2008-2016 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -2028,10 +2028,12 @@ ns_stats_dump(ns_server_t *server, FILE *fp) { if (zonestats != NULL) { char zonename[DNS_NAME_FORMATSIZE]; - dns_name_format(dns_zone_getorigin(zone), - zonename, sizeof(zonename)); view = dns_zone_getview(zone); + if (view == NULL) + continue; + dns_name_format(dns_zone_getorigin(zone), + zonename, sizeof(zonename)); fprintf(fp, "[%s", zonename); if (strcmp(view->name, "_default") != 0) fprintf(fp, " (view: %s)", view->name); diff --git a/contrib/bind9/bin/named/unix/include/named/os.h b/contrib/bind9/bin/named/unix/include/named/os.h index c979e5387..b0ac1d568 100644 --- a/contrib/bind9/bin/named/unix/include/named/os.h +++ b/contrib/bind9/bin/named/unix/include/named/os.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007-2009, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,8 +15,6 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: os.h,v 1.31 2009/08/05 23:47:43 tbox Exp $ */ - #ifndef NS_OS_H #define NS_OS_H 1 @@ -72,4 +70,7 @@ ns_os_tzset(void); void ns_os_started(void); +char * +ns_os_uname(void); + #endif /* NS_OS_H */ diff --git a/contrib/bind9/bin/named/unix/os.c b/contrib/bind9/bin/named/unix/os.c index 18e8c3910..953bbdd16 100644 --- a/contrib/bind9/bin/named/unix/os.c +++ b/contrib/bind9/bin/named/unix/os.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2011, 2013, 2014, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,8 +15,6 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: os.c,v 1.107 2011/03/02 00:02:54 marka Exp $ */ - /*! \file */ #include @@ -24,6 +22,9 @@ #include /* dev_t FreeBSD 2.1 */ #include +#ifdef HAVE_UNAME +#include +#endif #include #include @@ -966,3 +967,33 @@ ns_os_tzset(void) { tzset(); #endif } + +static char unamebuf[BUFSIZ]; +static char *unamep = NULL; + +static void +getuname(void) { +#ifdef HAVE_UNAME + struct utsname uts; + + memset(&uts, 0, sizeof(uts)); + if (uname(&uts) < 0) { + strcpy(unamebuf, "unknown architecture"); + return; + } + + snprintf(unamebuf, sizeof(unamebuf), + "%s %s %s %s", + uts.sysname, uts.machine, uts.release, uts.version); +#else + strcpy(unamebuf, "unknown architecture"); +#endif + unamep = unamebuf; +} + +char * +ns_os_uname(void) { + if (unamep == NULL) + getuname(); + return (unamep); +} diff --git a/contrib/bind9/bin/named/xfrout.c b/contrib/bind9/bin/named/xfrout.c index f8535b21e..351b61665 100644 --- a/contrib/bind9/bin/named/xfrout.c +++ b/contrib/bind9/bin/named/xfrout.c @@ -1246,6 +1246,7 @@ sendstream(xfrout_ctx_t *xfr) { dns_rdataset_t *msgrds = NULL; dns_compress_t cctx; isc_boolean_t cleanup_cctx = ISC_FALSE; + isc_boolean_t is_tcp; int n_rrs; @@ -1253,7 +1254,8 @@ sendstream(xfrout_ctx_t *xfr) { isc_buffer_clear(&xfr->txlenbuf); isc_buffer_clear(&xfr->txbuf); - if ((xfr->client->attributes & NS_CLIENTATTR_TCP) == 0) { + is_tcp = ISC_TF((xfr->client->attributes & NS_CLIENTATTR_TCP) != 0); + if (!is_tcp) { /* * In the UDP case, we put the response data directly into * the client message. @@ -1442,9 +1444,17 @@ sendstream(xfrout_ctx_t *xfr) { if (! xfr->many_answers) break; + /* + * At this stage, at least 1 RR has been rendered into + * the message. Check if we want to clamp this message + * here (TCP only). 20480 was set as an upper limit to + * improve message compression. + */ + if ((isc_buffer_usedlength(&xfr->buf) >= 20480) && is_tcp) + break; } - if ((xfr->client->attributes & NS_CLIENTATTR_TCP) != 0) { + if (is_tcp) { CHECK(dns_compress_init(&cctx, -1, xfr->mctx)); dns_compress_setsensitive(&cctx, ISC_TRUE); cleanup_cctx = ISC_TRUE; diff --git a/contrib/bind9/bin/nsupdate/Makefile.in b/contrib/bind9/bin/nsupdate/Makefile.in index 5dc20ad90..507341890 100644 --- a/contrib/bind9/bin/nsupdate/Makefile.in +++ b/contrib/bind9/bin/nsupdate/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2006-2009, 2012-2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2006-2009, 2012-2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000-2002 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @BIND9_MAKE_INCLUDES@ diff --git a/contrib/bind9/bin/nsupdate/nsupdate.1 b/contrib/bind9/bin/nsupdate/nsupdate.1 index 28d5f42d7..f5669ccec 100644 --- a/contrib/bind9/bin/nsupdate/nsupdate.1 +++ b/contrib/bind9/bin/nsupdate/nsupdate.1 @@ -13,164 +13,179 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: nsupdate .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: April 18, 2014 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2014-04-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "NSUPDATE" "1" "April 18, 2014" "BIND9" "BIND9" +.TH "NSUPDATE" "1" "2014\-04\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" nsupdate \- Dynamic DNS update utility .SH "SYNOPSIS" -.HP 9 +.HP \w'\fBnsupdate\fR\ 'u \fBnsupdate\fR [\fB\-d\fR] [\fB\-D\fR] [\fB\-L\ \fR\fB\fIlevel\fR\fR] [[\fB\-g\fR] | [\fB\-o\fR] | [\fB\-l\fR] | [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIkeyname:secret\fR\fR] | [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-R\ \fR\fB\fIrandomdev\fR\fR] [\fB\-v\fR] [\fB\-V\fR] [filename] .SH "DESCRIPTION" .PP \fBnsupdate\fR -is used to submit Dynamic DNS Update requests as defined in RFC 2136 to a name server. This allows resource records to be added or removed from a zone without manually editing the zone file. A single update request can contain requests to add or remove more than one resource record. +is used to submit Dynamic DNS Update requests as defined in RFC 2136 to a name server\&. This allows resource records to be added or removed from a zone without manually editing the zone file\&. A single update request can contain requests to add or remove more than one resource record\&. .PP Zones that are under dynamic control via \fBnsupdate\fR -or a DHCP server should not be edited by hand. Manual edits could conflict with dynamic updates and cause data to be lost. +or a DHCP server should not be edited by hand\&. Manual edits could conflict with dynamic updates and cause data to be lost\&. .PP The resource records that are dynamically added or removed with \fBnsupdate\fR -have to be in the same zone. Requests are sent to the zone's master server. This is identified by the MNAME field of the zone's SOA record. +have to be in the same zone\&. Requests are sent to the zone\*(Aqs master server\&. This is identified by the MNAME field of the zone\*(Aqs SOA record\&. .PP -Transaction signatures can be used to authenticate the Dynamic DNS updates. These use the TSIG resource record type described in RFC 2845 or the SIG(0) record described in RFC 2535 and RFC 2931 or GSS\-TSIG as described in RFC 3645. +Transaction signatures can be used to authenticate the Dynamic DNS updates\&. These use the TSIG resource record type described in RFC 2845 or the SIG(0) record described in RFC 2535 and RFC 2931 or GSS\-TSIG as described in RFC 3645\&. .PP TSIG relies on a shared secret that should only be known to \fBnsupdate\fR -and the name server. For instance, suitable +and the name server\&. For instance, suitable \fBkey\fR and \fBserver\fR statements would be added to -\fI/etc/named.conf\fR -so that the name server can associate the appropriate secret key and algorithm with the IP address of the client application that will be using TSIG authentication. You can use +/etc/named\&.conf +so that the name server can associate the appropriate secret key and algorithm with the IP address of the client application that will be using TSIG authentication\&. You can use \fBddns\-confgen\fR -to generate suitable configuration fragments. +to generate suitable configuration fragments\&. \fBnsupdate\fR uses the \fB\-y\fR or \fB\-k\fR -options to provide the TSIG shared secret. These options are mutually exclusive. +options to provide the TSIG shared secret\&. These options are mutually exclusive\&. .PP -SIG(0) uses public key cryptography. To use a SIG(0) key, the public key must be stored in a KEY record in a zone served by the name server. +SIG(0) uses public key cryptography\&. To use a SIG(0) key, the public key must be stored in a KEY record in a zone served by the name server\&. .PP -GSS\-TSIG uses Kerberos credentials. Standard GSS\-TSIG mode is switched on with the +GSS\-TSIG uses Kerberos credentials\&. Standard GSS\-TSIG mode is switched on with the \fB\-g\fR -flag. A non\-standards\-compliant variant of GSS\-TSIG used by Windows 2000 can be switched on with the +flag\&. A non\-standards\-compliant variant of GSS\-TSIG used by Windows 2000 can be switched on with the \fB\-o\fR -flag. +flag\&. .SH "OPTIONS" .PP \-d .RS 4 -Debug mode. This provides tracing information about the update requests that are made and the replies received from the name server. +Debug mode\&. This provides tracing information about the update requests that are made and the replies received from the name server\&. .RE .PP \-D .RS 4 -Extra debug mode. +Extra debug mode\&. .RE .PP \-k \fIkeyfile\fR .RS 4 -The file containing the TSIG authentication key. Keyfiles may be in two formats: a single file containing a -\fInamed.conf\fR\-format +The file containing the TSIG authentication key\&. Keyfiles may be in two formats: a single file containing a +named\&.conf\-format \fBkey\fR statement, which may be generated automatically by \fBddns\-confgen\fR, or a pair of files whose names are of the format -\fIK{name}.+157.+{random}.key\fR +K{name}\&.+157\&.+{random}\&.key and -\fIK{name}.+157.+{random}.private\fR, which can be generated by -\fBdnssec\-keygen\fR. The +K{name}\&.+157\&.+{random}\&.private, which can be generated by +\fBdnssec\-keygen\fR\&. The \fB\-k\fR -may also be used to specify a SIG(0) key used to authenticate Dynamic DNS update requests. In this case, the key specified is not an HMAC\-MD5 key. +may also be used to specify a SIG(0) key used to authenticate Dynamic DNS update requests\&. In this case, the key specified is not an HMAC\-MD5 key\&. .RE .PP \-l .RS 4 -Local\-host only mode. This sets the server address to localhost (disabling the +Local\-host only mode\&. This sets the server address to localhost (disabling the \fBserver\fR -so that the server address cannot be overridden). Connections to the local server will use a TSIG key found in -\fI/var/run/named/session.key\fR, which is automatically generated by +so that the server address cannot be overridden)\&. Connections to the local server will use a TSIG key found in +/var/run/named/session\&.key, which is automatically generated by \fBnamed\fR if any local master zone has set \fBupdate\-policy\fR to -\fBlocal\fR. The location of this key file can be overridden with the +\fBlocal\fR\&. The location of this key file can be overridden with the \fB\-k\fR -option. +option\&. .RE .PP \-L \fIlevel\fR .RS 4 -Set the logging debug level. If zero, logging is disabled. +Set the logging debug level\&. If zero, logging is disabled\&. .RE .PP \-p \fIport\fR .RS 4 -Set the port to use for connections to a name server. The default is 53. +Set the port to use for connections to a name server\&. The default is 53\&. .RE .PP \-r \fIudpretries\fR .RS 4 -The number of UDP retries. The default is 3. If zero, only one update request will be made. +The number of UDP retries\&. The default is 3\&. If zero, only one update request will be made\&. .RE .PP \-R \fIrandomdev\fR .RS 4 -Where to obtain randomness. If the operating system does not provide a -\fI/dev/random\fR -or equivalent device, the default source of randomness is keyboard input. -\fIrandomdev\fR -specifies the name of a character device or file containing random data to be used instead of the default. The special value -\fIkeyboard\fR -indicates that keyboard input should be used. This option may be specified multiple times. +Where to obtain randomness\&. If the operating system does not provide a +/dev/random +or equivalent device, the default source of randomness is keyboard input\&. +randomdev +specifies the name of a character device or file containing random data to be used instead of the default\&. The special value +keyboard +indicates that keyboard input should be used\&. This option may be specified multiple times\&. .RE .PP \-t \fItimeout\fR .RS 4 -The maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout. +The maximum time an update request can take before it is aborted\&. The default is 300 seconds\&. Zero can be used to disable the timeout\&. .RE .PP \-u \fIudptimeout\fR .RS 4 -The UDP retry interval. The default is 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries. +The UDP retry interval\&. The default is 3 seconds\&. If zero, the interval will be computed from the timeout interval and number of UDP retries\&. .RE .PP \-v .RS 4 -Use TCP even for small update requests. By default, +Use TCP even for small update requests\&. By default, \fBnsupdate\fR -uses UDP to send update requests to the name server unless they are too large to fit in a UDP request in which case TCP will be used. TCP may be preferable when a batch of update requests is made. +uses UDP to send update requests to the name server unless they are too large to fit in a UDP request in which case TCP will be used\&. TCP may be preferable when a batch of update requests is made\&. .RE .PP \-V .RS 4 -Print the version number and exit. +Print the version number and exit\&. .RE .PP \-y \fI[hmac:]\fR\fIkeyname:secret\fR .RS 4 -Literal TSIG authentication key. +Literal TSIG authentication key\&. \fIkeyname\fR is the name of the key, and \fIsecret\fR -is the base64 encoded shared secret. +is the base64 encoded shared secret\&. \fIhmac\fR is the name of the key algorithm; valid choices are hmac\-md5, @@ -178,105 +193,104 @@ hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384, or -hmac\-sha512. If +hmac\-sha512\&. If \fIhmac\fR is not specified, the default is -hmac\-md5. +hmac\-md5\&. .sp NOTE: Use of the \fB\-y\fR -option is discouraged because the shared secret is supplied as a command line argument in clear text. This may be visible in the output from +option is discouraged because the shared secret is supplied as a command line argument in clear text\&. This may be visible in the output from \fBps\fR(1) -or in a history file maintained by the user's shell. +or in a history file maintained by the user\*(Aqs shell\&. .RE .SH "INPUT FORMAT" .PP \fBnsupdate\fR reads input from \fIfilename\fR -or standard input. Each command is supplied on exactly one line of input. Some commands are for administrative purposes. The others are either update instructions or prerequisite checks on the contents of the zone. These checks set conditions that some name or set of resource records (RRset) either exists or is absent from the zone. These conditions must be met if the entire update request is to succeed. Updates will be rejected if the tests for the prerequisite conditions fail. +or standard input\&. Each command is supplied on exactly one line of input\&. Some commands are for administrative purposes\&. The others are either update instructions or prerequisite checks on the contents of the zone\&. These checks set conditions that some name or set of resource records (RRset) either exists or is absent from the zone\&. These conditions must be met if the entire update request is to succeed\&. Updates will be rejected if the tests for the prerequisite conditions fail\&. .PP -Every update request consists of zero or more prerequisites and zero or more updates. This allows a suitably authenticated update request to proceed if some specified resource records are present or missing from the zone. A blank input line (or the +Every update request consists of zero or more prerequisites and zero or more updates\&. This allows a suitably authenticated update request to proceed if some specified resource records are present or missing from the zone\&. A blank input line (or the \fBsend\fR -command) causes the accumulated commands to be sent as one Dynamic DNS update request to the name server. +command) causes the accumulated commands to be sent as one Dynamic DNS update request to the name server\&. .PP The command formats and their meaning are as follows: .PP \fBserver\fR {servername} [port] .RS 4 Sends all dynamic update requests to the name server -\fIservername\fR. When no server statement is provided, +\fIservername\fR\&. When no server statement is provided, \fBnsupdate\fR -will send updates to the master server of the correct zone. The MNAME field of that zone's SOA record will identify the master server for that zone. +will send updates to the master server of the correct zone\&. The MNAME field of that zone\*(Aqs SOA record will identify the master server for that zone\&. \fIport\fR is the port number on \fIservername\fR -where the dynamic update requests get sent. If no port number is specified, the default DNS port number of 53 is used. +where the dynamic update requests get sent\&. If no port number is specified, the default DNS port number of 53 is used\&. .RE .PP \fBlocal\fR {address} [port] .RS 4 Sends all dynamic update requests using the local -\fIaddress\fR. When no local statement is provided, +\fIaddress\fR\&. When no local statement is provided, \fBnsupdate\fR -will send updates using an address and port chosen by the system. +will send updates using an address and port chosen by the system\&. \fIport\fR -can additionally be used to make requests come from a specific port. If no port number is specified, the system will assign one. +can additionally be used to make requests come from a specific port\&. If no port number is specified, the system will assign one\&. .RE .PP \fBzone\fR {zonename} .RS 4 Specifies that all updates are to be made to the zone -\fIzonename\fR. If no +\fIzonename\fR\&. If no \fIzone\fR statement is provided, \fBnsupdate\fR -will attempt determine the correct zone to update based on the rest of the input. +will attempt determine the correct zone to update based on the rest of the input\&. .RE .PP \fBclass\fR {classname} .RS 4 -Specify the default class. If no +Specify the default class\&. If no \fIclass\fR is specified, the default class is -\fIIN\fR. +\fIIN\fR\&. .RE .PP \fBttl\fR {seconds} .RS 4 -Specify the default time to live for records to be added. The value +Specify the default time to live for records to be added\&. The value \fInone\fR -will clear the default ttl. +will clear the default ttl\&. .RE .PP \fBkey\fR [hmac:] {keyname} {secret} .RS 4 Specifies that all updates are to be TSIG\-signed using the -\fIkeyname\fR -\fIsecret\fR -pair. If +\fIkeyname\fR\fIsecret\fR +pair\&. If \fIhmac\fR is specified, then it sets the signing algorithm in use; the default is -hmac\-md5. The +hmac\-md5\&. The \fBkey\fR command overrides any key specified on the command line via \fB\-y\fR or -\fB\-k\fR. +\fB\-k\fR\&. .RE .PP \fBgsstsig\fR .RS 4 -Use GSS\-TSIG to sign the updated. This is equivalent to specifying +Use GSS\-TSIG to sign the updated\&. This is equivalent to specifying \fB\-g\fR -on the commandline. +on the commandline\&. .RE .PP \fBoldgsstsig\fR .RS 4 -Use the Windows 2000 version of GSS\-TSIG to sign the updated. This is equivalent to specifying +Use the Windows 2000 version of GSS\-TSIG to sign the updated\&. This is equivalent to specifying \fB\-o\fR -on the commandline. +on the commandline\&. .RE .PP \fBrealm\fR {[realm_name]} @@ -284,20 +298,20 @@ on the commandline. When using GSS\-TSIG use \fIrealm_name\fR rather than the default realm in -\fIkrb5.conf\fR. If no realm is specified the saved realm is cleared. +krb5\&.conf\&. If no realm is specified the saved realm is cleared\&. .RE .PP \fB[prereq]\fR\fB nxdomain\fR {domain\-name} .RS 4 Requires that no resource record of any type exists with name -\fIdomain\-name\fR. +\fIdomain\-name\fR\&. .RE .PP \fB[prereq]\fR\fB yxdomain\fR {domain\-name} .RS 4 Requires that \fIdomain\-name\fR -exists (has as at least one resource record, of any type). +exists (has as at least one resource record, of any type)\&. .RE .PP \fB[prereq]\fR\fB nxrrset\fR {domain\-name} [class] {type} @@ -306,9 +320,9 @@ Requires that no resource record exists of the specified \fItype\fR, \fIclass\fR and -\fIdomain\-name\fR. If +\fIdomain\-name\fR\&. If \fIclass\fR -is omitted, IN (internet) is assumed. +is omitted, IN (internet) is assumed\&. .RE .PP \fB[prereq]\fR\fB yxrrset\fR {domain\-name} [class] {type} @@ -318,9 +332,9 @@ This requires that a resource record of the specified \fIclass\fR and \fIdomain\-name\fR -must exist. If +must exist\&. If \fIclass\fR -is omitted, IN (internet) is assumed. +is omitted, IN (internet) is assumed\&. .RE .PP \fB[prereq]\fR\fB yxrrset\fR {domain\-name} [class] {type} {data...} @@ -331,26 +345,26 @@ from each set of prerequisites of this form sharing a common \fItype\fR, \fIclass\fR, and \fIdomain\-name\fR -are combined to form a set of RRs. This set of RRs must exactly match the set of RRs existing in the zone at the given +are combined to form a set of RRs\&. This set of RRs must exactly match the set of RRs existing in the zone at the given \fItype\fR, \fIclass\fR, and -\fIdomain\-name\fR. The +\fIdomain\-name\fR\&. The \fIdata\fR -are written in the standard text representation of the resource record's RDATA. +are written in the standard text representation of the resource record\*(Aqs RDATA\&. .RE .PP \fB[update]\fR\fB del\fR\fB[ete]\fR {domain\-name} [ttl] [class] [type\ [data...]] .RS 4 Deletes any resource records named -\fIdomain\-name\fR. If +\fIdomain\-name\fR\&. If \fItype\fR and \fIdata\fR -is provided, only matching resource records will be removed. The internet class is assumed if +is provided, only matching resource records will be removed\&. The internet class is assumed if \fIclass\fR -is not supplied. The +is not supplied\&. The \fIttl\fR -is ignored, and is only allowed for compatibility. +is ignored, and is only allowed for compatibility\&. .RE .PP \fB[update]\fR\fB add\fR {domain\-name} {ttl} [class] {type} {data...} @@ -359,99 +373,105 @@ Adds a new resource record with the specified \fIttl\fR, \fIclass\fR and -\fIdata\fR. +\fIdata\fR\&. .RE .PP \fBshow\fR .RS 4 -Displays the current message, containing all of the prerequisites and updates specified since the last send. +Displays the current message, containing all of the prerequisites and updates specified since the last send\&. .RE .PP \fBsend\fR .RS 4 -Sends the current message. This is equivalent to entering a blank line. +Sends the current message\&. This is equivalent to entering a blank line\&. .RE .PP \fBanswer\fR .RS 4 -Displays the answer. +Displays the answer\&. .RE .PP \fBdebug\fR .RS 4 -Turn on debugging. +Turn on debugging\&. .RE .PP \fBversion\fR .RS 4 -Print version number. +Print version number\&. .RE .PP \fBhelp\fR .RS 4 -Print a list of commands. +Print a list of commands\&. .RE .PP -Lines beginning with a semicolon are comments and are ignored. +Lines beginning with a semicolon are comments and are ignored\&. .SH "EXAMPLES" .PP The examples below show how \fBnsupdate\fR could be used to insert and delete resource records from the -\fBexample.com\fR -zone. Notice that the input in each example contains a trailing blank line so that a group of commands are sent as one dynamic update request to the master name server for -\fBexample.com\fR. +\fBexample\&.com\fR +zone\&. Notice that the input in each example contains a trailing blank line so that a group of commands are sent as one dynamic update request to the master name server for +\fBexample\&.com\fR\&. .sp +.if n \{\ .RS 4 +.\} .nf # nsupdate -> update delete oldhost.example.com A -> update add newhost.example.com 86400 A 172.16.1.1 +> update delete oldhost\&.example\&.com A +> update add newhost\&.example\&.com 86400 A 172\&.16\&.1\&.1 > send .fi +.if n \{\ .RE -.sp +.\} .PP Any A records for -\fBoldhost.example.com\fR -are deleted. And an A record for -\fBnewhost.example.com\fR -with IP address 172.16.1.1 is added. The newly\-added record has a 1 day TTL (86400 seconds). +\fBoldhost\&.example\&.com\fR +are deleted\&. And an A record for +\fBnewhost\&.example\&.com\fR +with IP address 172\&.16\&.1\&.1 is added\&. The newly\-added record has a 1 day TTL (86400 seconds)\&. .sp +.if n \{\ .RS 4 +.\} .nf # nsupdate -> prereq nxdomain nickname.example.com -> update add nickname.example.com 86400 CNAME somehost.example.com +> prereq nxdomain nickname\&.example\&.com +> update add nickname\&.example\&.com 86400 CNAME somehost\&.example\&.com > send .fi +.if n \{\ .RE -.sp +.\} .PP The prerequisite condition gets the name server to check that there are no resource records of any type for -\fBnickname.example.com\fR. If there are, the update request fails. If this name does not exist, a CNAME for it is added. This ensures that when the CNAME is added, it cannot conflict with the long\-standing rule in RFC 1034 that a name must not exist as any other record type if it exists as a CNAME. (The rule has been updated for DNSSEC in RFC 2535 to allow CNAMEs to have RRSIG, DNSKEY and NSEC records.) +\fBnickname\&.example\&.com\fR\&. If there are, the update request fails\&. If this name does not exist, a CNAME for it is added\&. This ensures that when the CNAME is added, it cannot conflict with the long\-standing rule in RFC 1034 that a name must not exist as any other record type if it exists as a CNAME\&. (The rule has been updated for DNSSEC in RFC 2535 to allow CNAMEs to have RRSIG, DNSKEY and NSEC records\&.) .SH "FILES" .PP -\fB/etc/resolv.conf\fR +\fB/etc/resolv\&.conf\fR .RS 4 used to identify default name server .RE .PP -\fB/var/run/named/session.key\fR +\fB/var/run/named/session\&.key\fR .RS 4 sets the default TSIG key for use in local\-only mode .RE .PP -\fBK{name}.+157.+{random}.key\fR +\fBK{name}\&.+157\&.+{random}\&.key\fR .RS 4 base\-64 encoding of HMAC\-MD5 key created by -\fBdnssec\-keygen\fR(8). +\fBdnssec-keygen\fR(8)\&. .RE .PP -\fBK{name}.+157.+{random}.private\fR +\fBK{name}\&.+157\&.+{random}\&.private\fR .RS 4 base\-64 encoding of HMAC\-MD5 key created by -\fBdnssec\-keygen\fR(8). +\fBdnssec-keygen\fR(8)\&. .RE .SH "SEE ALSO" .PP @@ -463,13 +483,17 @@ RFC 1034, RFC 2535, RFC 2931, \fBnamed\fR(8), -\fBddns\-confgen\fR(8), -\fBdnssec\-keygen\fR(8). +\fBddns-confgen\fR(8), +\fBdnssec-keygen\fR(8)\&. .SH "BUGS" .PP -The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases. +The TSIG key is redundantly stored in two separate files\&. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004\-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br -Copyright \(co 2000\-2003 Internet Software Consortium. +Copyright \(co 2004-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2000-2003 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/nsupdate/nsupdate.c b/contrib/bind9/bin/nsupdate/nsupdate.c index bf907f158..683e42b9b 100644 --- a/contrib/bind9/bin/nsupdate/nsupdate.c +++ b/contrib/bind9/bin/nsupdate/nsupdate.c @@ -218,6 +218,8 @@ typedef struct nsu_gssinfo { gss_ctx_id_t context; } nsu_gssinfo_t; +static void +failed_gssrequest(); static void start_gssrequest(dns_name_t *master); static void @@ -640,6 +642,8 @@ read_sessionkey(isc_mem_t *mctx, isc_log_t *lctx) { len = strlen(algorithm) + strlen(mykeyname) + strlen(secretstr) + 3; keystr = isc_mem_allocate(mctx, len); + if (keystr == NULL) + fatal("out of memory"); snprintf(keystr, len, "%s:%s:%s", algorithm, mykeyname, secretstr); setup_keystr(); @@ -2614,7 +2618,8 @@ get_ticket_realm(isc_mem_t *mctx) { krb5_error_code rc; krb5_ccache ccache; krb5_principal princ; - char *name, *ticket_realm; + char *name; + const char * ticket_realm; rc = krb5_init_context(&ctx); if (rc != 0) @@ -2654,6 +2659,15 @@ get_ticket_realm(isc_mem_t *mctx) { fprintf(stderr, "Found realm from ticket: %s\n", realm+1); } +static void +failed_gssrequest() { + seenerror = ISC_TRUE; + + dns_name_free(&tmpzonename, gmctx); + dns_name_free(&restart_master, gmctx); + + done_update(); +} static void start_gssrequest(dns_name_t *master) { @@ -2661,7 +2675,7 @@ start_gssrequest(dns_name_t *master) { isc_buffer_t buf; isc_result_t result; isc_uint32_t val = 0; - dns_message_t *rmsg; + dns_message_t *rmsg = NULL; dns_request_t *request = NULL; dns_name_t *servname; dns_fixedname_t fname; @@ -2741,14 +2755,24 @@ start_gssrequest(dns_name_t *master) { result = dns_tkey_buildgssquery(rmsg, keyname, servname, NULL, 0, &context, use_win2k_gsstsig, gmctx, &err_message); - if (result == ISC_R_FAILURE) - fatal("tkey query failed: %s", - err_message != NULL ? err_message : "unknown error"); + if (result == ISC_R_FAILURE) { + fprintf(stderr, "tkey query failed: %s\n", + err_message != NULL ? err_message : "unknown error"); + goto failure; + } if (result != ISC_R_SUCCESS) fatal("dns_tkey_buildgssquery failed: %s", isc_result_totext(result)); send_gssrequest(kserver, rmsg, &request, context); + return; + +failure: + if (rmsg != NULL) + dns_message_destroy(&rmsg); + if (err_message != NULL) + isc_mem_free(gmctx, err_message); + failed_gssrequest(); } static void diff --git a/contrib/bind9/bin/nsupdate/nsupdate.docbook b/contrib/bind9/bin/nsupdate/nsupdate.docbook index b973c1f69..f88144b27 100644 --- a/contrib/bind9/bin/nsupdate/nsupdate.docbook +++ b/contrib/bind9/bin/nsupdate/nsupdate.docbook @@ -1,6 +1,3 @@ -]> - + + + + 2014-04-18 + - April 18, 2014 + ISC + Internet Systems Consortium, Inc. nsupdate @@ -57,30 +59,30 @@ - + nsupdate - - - - - - - - - + + + + + + + + + - - - - - - - filename + + + + + + + filename - - DESCRIPTION + DESCRIPTION + nsupdate is used to submit Dynamic DNS Update requests as defined in RFC 2136 to a name server. @@ -136,10 +138,10 @@ non-standards-compliant variant of GSS-TSIG used by Windows 2000 can be switched on with the flag. - + + + OPTIONS - - OPTIONS @@ -313,10 +315,10 @@ - + + + INPUT FORMAT - - INPUT FORMAT nsupdate reads input from filename @@ -348,8 +350,8 @@ server - servername - port + servername + port @@ -375,8 +377,8 @@ local - address - port + address + port @@ -398,7 +400,7 @@ zone - zonename + zonename @@ -417,7 +419,7 @@ class - classname + classname @@ -432,7 +434,7 @@ ttl - seconds + seconds @@ -446,8 +448,8 @@ key - hmac:keyname - secret + hmac:keyname + secret @@ -490,7 +492,7 @@ realm - realm_name + realm_name @@ -504,7 +506,7 @@ prereq nxdomain - domain-name + domain-name @@ -518,7 +520,7 @@ prereq yxdomain - domain-name + domain-name @@ -532,9 +534,9 @@ prereq nxrrset - domain-name - class - type + domain-name + class + type @@ -554,9 +556,9 @@ prereq yxrrset - domain-name - class - type + domain-name + class + type @@ -576,9 +578,9 @@ prereq yxrrset - domain-name - class - type + domain-name + class + type data @@ -610,10 +612,10 @@ update delete - domain-name - ttl - class - type data + domain-name + ttl + class + type data @@ -636,10 +638,10 @@ update add - domain-name - ttl - class - type + domain-name + ttl + class + type data @@ -729,10 +731,10 @@ Lines beginning with a semicolon are comments and are ignored. - + + + EXAMPLES - - EXAMPLES The examples below show how nsupdate @@ -780,10 +782,10 @@ (The rule has been updated for DNSSEC in RFC 2535 to allow CNAMEs to have RRSIG, DNSKEY and NSEC records.) - + + + FILES - - FILES @@ -829,10 +831,10 @@ - + + + SEE ALSO - - SEE ALSO RFC 2136, RFC 3007, @@ -851,19 +853,15 @@ dnssec-keygen8 . - + + + BUGS - - BUGS The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases. - - + + diff --git a/contrib/bind9/bin/nsupdate/nsupdate.html b/contrib/bind9/bin/nsupdate/nsupdate.html index 76c54db29..7f1c8c229 100644 --- a/contrib/bind9/bin/nsupdate/nsupdate.html +++ b/contrib/bind9/bin/nsupdate/nsupdate.html @@ -14,14 +14,13 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - nsupdate - + -
    +

    Name

    @@ -31,9 +30,9 @@

    Synopsis

    nsupdate [-d] [-D] [-L level] [[-g] | [-o] | [-l] | [-y [hmac:]keyname:secret] | [-k keyfile]] [-t timeout] [-u udptimeout] [-r udpretries] [-R randomdev] [-v] [-V] [filename]

    -
    -

    DESCRIPTION

    -

    nsupdate +

    +

    DESCRIPTION

    +

    nsupdate is used to submit Dynamic DNS Update requests as defined in RFC 2136 to a name server. This allows resource records to be added or removed from a zone @@ -44,14 +43,14 @@

    Zones that are under dynamic control via - nsupdate + nsupdate or a DHCP server should not be edited by hand. Manual edits could conflict with dynamic updates and cause data to be lost.

    The resource records that are dynamically added or removed with - nsupdate + nsupdate have to be in the same zone. Requests are sent to the zone's master server. This is identified by the MNAME field of the zone's SOA record. @@ -65,15 +64,15 @@

    TSIG relies on a shared secret that should only be known to - nsupdate and the name server. + nsupdate and the name server. For instance, suitable key and server statements would be added to /etc/named.conf so that the name server can associate the appropriate secret key and algorithm with the IP address of the client application that will be using - TSIG authentication. You can use ddns-confgen + TSIG authentication. You can use ddns-confgen to generate suitable configuration fragments. - nsupdate + nsupdate uses the -y or -k options to provide the TSIG shared secret. These options are mutually exclusive.

    @@ -89,9 +88,9 @@ 2000 can be switched on with the -o flag.

    -
    -

    OPTIONS

    -
    +
    +

    OPTIONS

    +
    -d

    Debug mode. This provides tracing information about the @@ -106,12 +105,12 @@

    The file containing the TSIG authentication key. Keyfiles may be in two formats: a single file containing - a named.conf-format key + a named.conf-format key statement, which may be generated automatically by - ddns-confgen, or a pair of files whose names are + ddns-confgen, or a pair of files whose names are of the format K{name}.+157.+{random}.key and K{name}.+157.+{random}.private, which can be - generated by dnssec-keygen. + generated by dnssec-keygen. The -k may also be used to specify a SIG(0) key used to authenticate Dynamic DNS update requests. In this case, the key specified is not an HMAC-MD5 key. @@ -119,12 +118,12 @@

    -l

    Local-host only mode. This sets the server address to - localhost (disabling the server so that the server + localhost (disabling the server so that the server address cannot be overridden). Connections to the local server will use a TSIG key found in /var/run/named/session.key, - which is automatically generated by named if any - local master zone has set update-policy to - local. The location of this key file can be + which is automatically generated by named if any + local master zone has set update-policy to + local. The location of this key file can be overridden with the -k option.

    -L level
    @@ -167,7 +166,7 @@
    -v

    Use TCP even for small update requests. - By default, nsupdate + By default, nsupdate uses UDP to send update requests to the name server unless they are too large to fit in a UDP request in which case TCP will be used. TCP may be preferable when a batch of update requests is made. @@ -199,9 +198,9 @@

    -
    -

    INPUT FORMAT

    -

    nsupdate +

    +

    INPUT FORMAT

    +

    nsupdate reads input from filename or standard input. @@ -220,7 +219,7 @@ and zero or more updates. This allows a suitably authenticated update request to proceed if some specified resource records are present or missing from the zone. - A blank input line (or the send command) + A blank input line (or the send command) causes the accumulated commands to be sent as one Dynamic DNS update request to the name server. @@ -228,9 +227,9 @@

    The command formats and their meaning are as follows:

    -
    +
    - server + server {servername} [port]
    @@ -238,7 +237,7 @@ Sends all dynamic update requests to the name server servername. When no server statement is provided, - nsupdate + nsupdate will send updates to the master server of the correct zone. The MNAME field of that zone's SOA record will identify the master @@ -252,7 +251,7 @@ used.

    - local + local {address} [port]
    @@ -261,7 +260,7 @@ address. When no local statement is provided, - nsupdate + nsupdate will send updates using an address and port chosen by the system. port @@ -270,7 +269,7 @@ If no port number is specified, the system will assign one.

    - zone + zone {zonename}

    @@ -279,12 +278,12 @@ If no zone statement is provided, - nsupdate + nsupdate will attempt determine the correct zone to update based on the rest of the input.

    - class + class {classname}

    @@ -294,7 +293,7 @@ IN.

    - ttl + ttl {seconds}

    @@ -303,7 +302,7 @@ ttl.

    - key + key [hmac:] {keyname} {secret}
    @@ -312,19 +311,19 @@ keyname secret pair. If hmac is specified, then it sets the signing algorithm in use; the default is - hmac-md5. The key + hmac-md5. The key command overrides any key specified on the command line via -y or -k.

    - gsstsig + gsstsig

    Use GSS-TSIG to sign the updated. This is equivalent to specifying -g on the commandline.

    - oldgsstsig + oldgsstsig

    Use the Windows 2000 version of GSS-TSIG to sign the updated. @@ -332,7 +331,7 @@ commandline.

    - realm + realm {[realm_name]}

    @@ -341,7 +340,7 @@ realm is specified the saved realm is cleared.

    - [prereq] nxdomain + [prereq] nxdomain {domain-name}

    @@ -349,7 +348,7 @@ domain-name.

    - [prereq] yxdomain + [prereq] yxdomain {domain-name}

    @@ -358,7 +357,7 @@ exists (has as at least one resource record, of any type).

    - [prereq] nxrrset + [prereq] nxrrset {domain-name} [class] {type} @@ -374,7 +373,7 @@ is omitted, IN (internet) is assumed.

    - [prereq] yxrrset + [prereq] yxrrset {domain-name} [class] {type} @@ -391,7 +390,7 @@ is omitted, IN (internet) is assumed.

    - [prereq] yxrrset + [prereq] yxrrset {domain-name} [class] {type} @@ -420,7 +419,7 @@ RDATA.

    - [update] del[ete] + [update] del[ete] {domain-name} [ttl] [class] @@ -441,7 +440,7 @@ is ignored, and is only allowed for compatibility.

    - [update] add + [update] add {domain-name} {ttl} [class] @@ -456,7 +455,7 @@ data.

    - show + show

    Displays the current message, containing all of the @@ -464,32 +463,32 @@ updates specified since the last send.

    - send + send

    Sends the current message. This is equivalent to entering a blank line.

    - answer + answer

    Displays the answer.

    - debug + debug

    Turn on debugging.

    - version + version

    Print version number.

    - help + help

    Print a list of commands. @@ -501,11 +500,11 @@ Lines beginning with a semicolon are comments and are ignored.

    -
    -

    EXAMPLES

    +
    +

    EXAMPLES

    The examples below show how - nsupdate + nsupdate could be used to insert and delete resource records from the example.com zone. @@ -555,9 +554,9 @@ RRSIG, DNSKEY and NSEC records.)

    -
    -

    FILES

    -
    +
    +

    FILES

    +
    /etc/resolv.conf

    used to identify default name server @@ -578,8 +577,8 @@

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    RFC 2136, RFC 3007, @@ -593,8 +592,8 @@ dnssec-keygen(8).

    -
    -

    BUGS

    +
    +

    BUGS

    The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library diff --git a/contrib/bind9/bin/rndc/Makefile.in b/contrib/bind9/bin/rndc/Makefile.in index f6100df9e..a1a0ec398 100644 --- a/contrib/bind9/bin/rndc/Makefile.in +++ b/contrib/bind9/bin/rndc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007, 2009, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000-2002 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @BIND9_MAKE_INCLUDES@ diff --git a/contrib/bind9/bin/rndc/rndc.8 b/contrib/bind9/bin/rndc/rndc.8 index 503108e69..bbdda2a97 100644 --- a/contrib/bind9/bin/rndc/rndc.8 +++ b/contrib/bind9/bin/rndc/rndc.8 @@ -13,51 +13,66 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: rndc .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: December 04, 2013 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2013-12-04 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "RNDC" "8" "December 04, 2013" "BIND9" "BIND9" +.TH "RNDC" "8" "2013\-12\-04" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" rndc \- name server control utility .SH "SYNOPSIS" -.HP 5 +.HP \w'\fBrndc\fR\ 'u \fBrndc\fR [\fB\-b\ \fR\fB\fIsource\-address\fR\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-k\ \fR\fB\fIkey\-file\fR\fR] [\fB\-s\ \fR\fB\fIserver\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-V\fR] [\fB\-y\ \fR\fB\fIkey_id\fR\fR] {command} .SH "DESCRIPTION" .PP \fBrndc\fR -controls the operation of a name server. It supersedes the +controls the operation of a name server\&. It supersedes the \fBndc\fR -utility that was provided in old BIND releases. If +utility that was provided in old BIND releases\&. If \fBrndc\fR -is invoked with no command line options or arguments, it prints a short summary of the supported commands and the available options and their arguments. +is invoked with no command line options or arguments, it prints a short summary of the supported commands and the available options and their arguments\&. .PP \fBrndc\fR -communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of +communicates with the name server over a TCP connection, sending commands authenticated with digital signatures\&. In the current versions of \fBrndc\fR and -\fBnamed\fR, the only supported authentication algorithm is HMAC\-MD5, which uses a shared secret on each end of the connection. This provides TSIG\-style authentication for the command request and the name server's response. All commands sent over the channel must be signed by a key_id known to the server. +\fBnamed\fR, the only supported authentication algorithm is HMAC\-MD5, which uses a shared secret on each end of the connection\&. This provides TSIG\-style authentication for the command request and the name server\*(Aqs response\&. All commands sent over the channel must be signed by a key_id known to the server\&. .PP \fBrndc\fR -reads a configuration file to determine how to contact the name server and decide what algorithm and key it should use. +reads a configuration file to determine how to contact the name server and decide what algorithm and key it should use\&. .SH "OPTIONS" .PP \-b \fIsource\-address\fR .RS 4 Use \fIsource\-address\fR -as the source address for the connection to the server. Multiple instances are permitted to allow setting of both the IPv4 and IPv6 source addresses. +as the source address for the connection to the server\&. Multiple instances are permitted to allow setting of both the IPv4 and IPv6 source addresses\&. .RE .PP \-c \fIconfig\-file\fR @@ -65,7 +80,7 @@ as the source address for the connection to the server. Multiple instances are p Use \fIconfig\-file\fR as the configuration file instead of the default, -\fI/etc/rndc.conf\fR. +/etc/rndc\&.conf\&. .RE .PP \-k \fIkey\-file\fR @@ -73,47 +88,47 @@ as the configuration file instead of the default, Use \fIkey\-file\fR as the key file instead of the default, -\fI/etc/rndc.key\fR. The key in -\fI/etc/rndc.key\fR +/etc/rndc\&.key\&. The key in +/etc/rndc\&.key will be used to authenticate commands sent to the server if the \fIconfig\-file\fR -does not exist. +does not exist\&. .RE .PP \-s \fIserver\fR .RS 4 \fIserver\fR is the name or address of the server which matches a server statement in the configuration file for -\fBrndc\fR. If no server is supplied on the command line, the host named by the default\-server clause in the options statement of the +\fBrndc\fR\&. If no server is supplied on the command line, the host named by the default\-server clause in the options statement of the \fBrndc\fR -configuration file will be used. +configuration file will be used\&. .RE .PP \-p \fIport\fR .RS 4 Send commands to TCP port \fIport\fR -instead of BIND 9's default control channel port, 953. +instead of BIND 9\*(Aqs default control channel port, 953\&. .RE .PP \-V .RS 4 -Enable verbose logging. +Enable verbose logging\&. .RE .PP \-y \fIkey_id\fR .RS 4 Use the key \fIkey_id\fR -from the configuration file. +from the configuration file\&. \fIkey_id\fR must be known by \fBnamed\fR -with the same algorithm and secret string in order for control message validation to succeed. If no +with the same algorithm and secret string in order for control message validation to succeed\&. If no \fIkey_id\fR is specified, \fBrndc\fR -will first look for a key clause in the server statement of the server being used, or if no server statement is present for that host, then the default\-key clause of the options statement. Note that the configuration file contains shared secrets which are used to send authenticated control commands to name servers. It should therefore not have general read or write access. +will first look for a key clause in the server statement of the server being used, or if no server statement is present for that host, then the default\-key clause of the options statement\&. Note that the configuration file contains shared secrets which are used to send authenticated control commands to name servers\&. It should therefore not have general read or write access\&. .RE .SH "COMMANDS" .PP @@ -121,338 +136,338 @@ A list of commands supported by \fBrndc\fR can be seen by running \fBrndc\fR -without arguments. +without arguments\&. .PP Currently supported commands are: .PP \fBaddzone \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR\fB \fR\fB\fIconfiguration\fR\fR\fB \fR .RS 4 -Add a zone while the server is running. This command requires the +Add a zone while the server is running\&. This command requires the \fBallow\-new\-zones\fR option to be set to -\fByes\fR. The +\fByes\fR\&. The \fIconfiguration\fR string specified on the command line is the zone configuration text that would ordinarily be placed in -\fInamed.conf\fR. +named\&.conf\&. .sp The configuration is saved in a file called -\fI\fIhash\fR\fR\fI.nzf\fR, where +\fIhash\fR\&.nzf, where \fIhash\fR -is a cryptographic hash generated from the name of the view. When +is a cryptographic hash generated from the name of the view\&. When \fBnamed\fR -is restarted, the file will be loaded into the view configuration, so that zones that were added can persist after a restart. +is restarted, the file will be loaded into the view configuration, so that zones that were added can persist after a restart\&. .sp This sample \fBaddzone\fR command would add the zone -example.com +example\&.com to the default view: .sp -$\fBrndc addzone example.com '{ type master; file "example.com.db"; };'\fR +$\fBrndc addzone example\&.com \*(Aq{ type master; file "example\&.com\&.db"; };\*(Aq\fR .sp -(Note the brackets and semi\-colon around the zone configuration text.) +(Note the brackets and semi\-colon around the zone configuration text\&.) .sp See also -\fBrndc delzone\fR. +\fBrndc delzone\fR\&. .RE .PP \fBdelzone \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR\fB \fR .RS 4 -Delete a zone while the server is running. Only zones that were originally added via +Delete a zone while the server is running\&. Only zones that were originally added via \fBrndc addzone\fR -can be deleted in this manner. +can be deleted in this manner\&. .sp See also \fBrndc addzone\fR .RE .PP -\fBdumpdb \fR\fB[\-all|\-cache|\-zone|\-adb|\-bad]\fR\fB \fR\fB[\fIview ...\fR]\fR +\fBdumpdb \fR\fB[\-all|\-cache|\-zone|\-adb|\-bad]\fR\fB \fR\fB[\fIview \&.\&.\&.\fR]\fR .RS 4 -Dump the server's caches (default) and/or zones to the dump file for the specified views. If no view is specified, all views are dumped. (See the +Dump the server\*(Aqs caches (default) and/or zones to the dump file for the specified views\&. If no view is specified, all views are dumped\&. (See the \fBdump\-file\fR -option in the BIND 9 Administrator Reference Manual.) +option in the BIND 9 Administrator Reference Manual\&.) .RE .PP \fBflush\fR .RS 4 -Flushes the server's cache. +Flushes the server\*(Aqs cache\&. .RE .PP \fBflushname\fR \fIname\fR [\fIview\fR] .RS 4 -Flushes the given name from the view's DNS cache and, if applicable, from the view's nameserver address database or bad\-server cache. +Flushes the given name from the view\*(Aqs DNS cache and, if applicable, from the view\*(Aqs nameserver address database or bad\-server cache\&. .RE .PP \fBflushtree\fR \fIname\fR [\fIview\fR] .RS 4 -Flushes the given name, and all of its subdomains, from the view's DNS cache. Note that this does +Flushes the given name, and all of its subdomains, from the view\*(Aqs DNS cache\&. Note that this does \fInot\fR -affect he server's address database or bad\-server cache. +affect he server\*(Aqs address database or bad\-server cache\&. .RE .PP \fBfreeze \fR\fB[\fIzone\fR [\fIclass\fR [\fIview\fR]]]\fR .RS 4 -Suspend updates to a dynamic zone. If no zone is specified, then all zones are suspended. This allows manual edits to be made to a zone normally updated by dynamic update. It also causes changes in the journal file to be synced into the master file. All dynamic update attempts will be refused while the zone is frozen. +Suspend updates to a dynamic zone\&. If no zone is specified, then all zones are suspended\&. This allows manual edits to be made to a zone normally updated by dynamic update\&. It also causes changes in the journal file to be synced into the master file\&. All dynamic update attempts will be refused while the zone is frozen\&. .sp See also -\fBrndc thaw\fR. +\fBrndc thaw\fR\&. .RE .PP \fBhalt \fR\fB[\-p]\fR .RS 4 -Stop the server immediately. Recent changes made through dynamic update or IXFR are not saved to the master files, but will be rolled forward from the journal files when the server is restarted. If +Stop the server immediately\&. Recent changes made through dynamic update or IXFR are not saved to the master files, but will be rolled forward from the journal files when the server is restarted\&. If \fB\-p\fR is specified -\fBnamed\fR's process id is returned. This allows an external process to determine when +\fBnamed\fR\*(Aqs process id is returned\&. This allows an external process to determine when \fBnamed\fR -had completed halting. +had completed halting\&. .sp See also -\fBrndc stop\fR. +\fBrndc stop\fR\&. .RE .PP \fBloadkeys \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR .RS 4 -Fetch all DNSSEC keys for the given zone from the key directory. If they are within their publication period, merge them into the zone's DNSKEY RRset. Unlike -\fBrndc sign\fR, however, the zone is not immediately re\-signed by the new keys, but is allowed to incrementally re\-sign over time. +Fetch all DNSSEC keys for the given zone from the key directory\&. If they are within their publication period, merge them into the zone\*(Aqs DNSKEY RRset\&. Unlike +\fBrndc sign\fR, however, the zone is not immediately re\-signed by the new keys, but is allowed to incrementally re\-sign over time\&. .sp This command requires that the \fBauto\-dnssec\fR zone option be set to -maintain, and also requires the zone to be configured to allow dynamic DNS. (See "Dynamic Update Policies" in the Administrator Reference Manual for more details.) +maintain, and also requires the zone to be configured to allow dynamic DNS\&. (See "Dynamic Update Policies" in the Administrator Reference Manual for more details\&.) .RE .PP \fBnotify \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR .RS 4 -Resend NOTIFY messages for the zone. +Resend NOTIFY messages for the zone\&. .RE .PP \fBnotrace\fR .RS 4 -Sets the server's debugging level to 0. +Sets the server\*(Aqs debugging level to 0\&. .sp See also -\fBrndc trace\fR. +\fBrndc trace\fR\&. .RE .PP \fBquerylog\fR [on|off] .RS 4 -Enable or disable query logging. (For backward compatibility, this command can also be used without an argument to toggle query logging on and off.) +Enable or disable query logging\&. (For backward compatibility, this command can also be used without an argument to toggle query logging on and off\&.) .sp Query logging can also be enabled by explicitly directing the -\fBqueries\fR -\fBcategory\fR +\fBqueries\fR\fBcategory\fR to a \fBchannel\fR in the \fBlogging\fR section of -\fInamed.conf\fR +named\&.conf or by specifying \fBquerylog yes;\fR in the \fBoptions\fR section of -\fInamed.conf\fR. +named\&.conf\&. .RE .PP \fBreconfig\fR .RS 4 -Reload the configuration file and load new zones, but do not reload existing zone files even if they have changed. This is faster than a full +Reload the configuration file and load new zones, but do not reload existing zone files even if they have changed\&. This is faster than a full \fBreload\fR -when there is a large number of zones because it avoids the need to examine the modification times of the zones files. +when there is a large number of zones because it avoids the need to examine the modification times of the zones files\&. .RE .PP \fBrecursing\fR .RS 4 Dump the list of queries \fBnamed\fR -is currently recursing on, and the list of domains to which iterative queries are currently being sent. (The second list includes the number of fetches currently active for the given domain, and how many have been passed or dropped because of the +is currently recursing on, and the list of domains to which iterative queries are currently being sent\&. (The second list includes the number of fetches currently active for the given domain, and how many have been passed or dropped because of the \fBfetches\-per\-zone\fR -option.) +option\&.) .RE .PP \fBrefresh \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR .RS 4 -Schedule zone maintenance for the given zone. +Schedule zone maintenance for the given zone\&. .RE .PP \fBreload\fR .RS 4 -Reload configuration file and zones. +Reload configuration file and zones\&. .RE .PP \fBreload \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR .RS 4 -Reload the given zone. +Reload the given zone\&. .RE .PP \fBretransfer \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR .RS 4 -Retransfer the given slave zone from the master server. +Retransfer the given slave zone from the master server\&. .sp If the zone is configured to use -\fBinline\-signing\fR, the signed version of the zone is discarded; after the retransfer of the unsigned version is complete, the signed version will be regenerated with all new signatures. +\fBinline\-signing\fR, the signed version of the zone is discarded; after the retransfer of the unsigned version is complete, the signed version will be regenerated with all new signatures\&. .RE .PP -\fBsecroots \fR\fB[\fIview ...\fR]\fR +\fBsecroots \fR\fB[\fIview \&.\&.\&.\fR]\fR .RS 4 -Dump the server's security roots to the secroots file for the specified views. If no view is specified, security roots for all views are dumped. +Dump the server\*(Aqs security roots to the secroots file for the specified views\&. If no view is specified, security roots for all views are dumped\&. .RE .PP \fBsign \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR .RS 4 Fetch all DNSSEC keys for the given zone from the key directory (see the \fBkey\-directory\fR -option in the BIND 9 Administrator Reference Manual). If they are within their publication period, merge them into the zone's DNSKEY RRset. If the DNSKEY RRset is changed, then the zone is automatically re\-signed with the new key set. +option in the BIND 9 Administrator Reference Manual)\&. If they are within their publication period, merge them into the zone\*(Aqs DNSKEY RRset\&. If the DNSKEY RRset is changed, then the zone is automatically re\-signed with the new key set\&. .sp This command requires that the \fBauto\-dnssec\fR zone option be set to allow or -maintain, and also requires the zone to be configured to allow dynamic DNS. (See "Dynamic Update Policies" in the Administrator Reference Manual for more details.) +maintain, and also requires the zone to be configured to allow dynamic DNS\&. (See "Dynamic Update Policies" in the Administrator Reference Manual for more details\&.) .sp See also -\fBrndc loadkeys\fR. +\fBrndc loadkeys\fR\&. .RE .PP \fBsigning \fR\fB[( \-list | \-clear \fIkeyid/algorithm\fR | \-clear all | \-nsec3param ( \fIparameters\fR | none ) ) ]\fR\fB \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR\fB \fR .RS 4 -List, edit, or remove the DNSSEC signing state records for the specified zone. The status of ongoing DNSSEC operations (such as signing or generating NSEC3 chains) is stored in the zone in the form of DNS resource records of type -\fBsig\-signing\-type\fR. +List, edit, or remove the DNSSEC signing state records for the specified zone\&. The status of ongoing DNSSEC operations (such as signing or generating NSEC3 chains) is stored in the zone in the form of DNS resource records of type +\fBsig\-signing\-type\fR\&. \fBrndc signing \-list\fR -converts these records into a human\-readable form, indicating which keys are currently signing or have finished signing the zone, and which NSEC3 chains are being created or removed. +converts these records into a human\-readable form, indicating which keys are currently signing or have finished signing the zone, and which NSEC3 chains are being created or removed\&. .sp \fBrndc signing \-clear\fR can remove a single key (specified in the same format that \fBrndc signing \-list\fR -uses to display it), or all keys. In either case, only completed keys are removed; any record indicating that a key has not yet finished signing the zone will be retained. +uses to display it), or all keys\&. In either case, only completed keys are removed; any record indicating that a key has not yet finished signing the zone will be retained\&. .sp \fBrndc signing \-nsec3param\fR -sets the NSEC3 parameters for a zone. This is the only supported mechanism for using NSEC3 with +sets the NSEC3 parameters for a zone\&. This is the only supported mechanism for using NSEC3 with \fBinline\-signing\fR -zones. Parameters are specified in the same format as an NSEC3PARAM resource record: hash algorithm, flags, iterations, and salt, in that order. +zones\&. Parameters are specified in the same format as an NSEC3PARAM resource record: hash algorithm, flags, iterations, and salt, in that order\&. .sp Currently, the only defined value for hash algorithm is -1, representing SHA\-1. The +1, representing SHA\-1\&. The \fBflags\fR may be set to 0 or -1, depending on whether you wish to set the opt\-out bit in the NSEC3 chain. +1, depending on whether you wish to set the opt\-out bit in the NSEC3 chain\&. \fBiterations\fR -defines the number of additional times to apply the algorithm when generating an NSEC3 hash. The +defines the number of additional times to apply the algorithm when generating an NSEC3 hash\&. The \fBsalt\fR -is a string of data expressed in hexadecimal, or a hyphen (`\-') if no salt is to be used. +is a string of data expressed in hexadecimal, or a hyphen (`\-\*(Aq) if no salt is to be used\&. .sp So, for example, to create an NSEC3 chain using the SHA\-1 hash algorithm, no opt\-out flag, 10 iterations, and a salt value of "FFFF", use: -\fBrndc signing \-nsec3param 1 0 10 FFFF \fR\fB\fIzone\fR\fR. To set the opt\-out flag, 15 iterations, and no salt, use: -\fBrndc signing \-nsec3param 1 1 15 \- \fR\fB\fIzone\fR\fR. +\fBrndc signing \-nsec3param 1 0 10 FFFF \fR\fB\fIzone\fR\fR\&. To set the opt\-out flag, 15 iterations, and no salt, use: +\fBrndc signing \-nsec3param 1 1 15 \- \fR\fB\fIzone\fR\fR\&. .sp \fBrndc signing \-nsec3param none\fR -removes an existing NSEC3 chain and replaces it with NSEC. +removes an existing NSEC3 chain and replaces it with NSEC\&. .RE .PP \fBstats\fR .RS 4 -Write server statistics to the statistics file. (See the +Write server statistics to the statistics file\&. (See the \fBstatistics\-file\fR -option in the BIND 9 Administrator Reference Manual.) +option in the BIND 9 Administrator Reference Manual\&.) .RE .PP \fBstatus\fR .RS 4 -Display status of the server. Note that the number of zones includes the internal +Display status of the server\&. Note that the number of zones includes the internal \fBbind/CH\fR zone and the default -\fB./IN\fR -hint zone if there is not an explicit root zone configured. +\fB\&./IN\fR +hint zone if there is not an explicit root zone configured\&. .RE .PP \fBstop \fR\fB[\-p]\fR .RS 4 -Stop the server, making sure any recent changes made through dynamic update or IXFR are first saved to the master files of the updated zones. If +Stop the server, making sure any recent changes made through dynamic update or IXFR are first saved to the master files of the updated zones\&. If \fB\-p\fR is specified -\fBnamed\fR's process id is returned. This allows an external process to determine when +\fBnamed\fR\*(Aqs process id is returned\&. This allows an external process to determine when \fBnamed\fR -had completed stopping. +had completed stopping\&. .sp See also -\fBrndc halt\fR. +\fBrndc halt\fR\&. .RE .PP \fBsync \fR\fB[\-clean]\fR\fB \fR\fB[\fIzone\fR [\fIclass\fR [\fIview\fR]]]\fR .RS 4 -Sync changes in the journal file for a dynamic zone to the master file. If the "\-clean" option is specified, the journal file is also removed. If no zone is specified, then all zones are synced. +Sync changes in the journal file for a dynamic zone to the master file\&. If the "\-clean" option is specified, the journal file is also removed\&. If no zone is specified, then all zones are synced\&. .RE .PP \fBthaw \fR\fB[\fIzone\fR [\fIclass\fR [\fIview\fR]]]\fR .RS 4 -Enable updates to a frozen dynamic zone. If no zone is specified, then all frozen zones are enabled. This causes the server to reload the zone from disk, and re\-enables dynamic updates after the load has completed. After a zone is thawed, dynamic updates will no longer be refused. If the zone has changed and the +Enable updates to a frozen dynamic zone\&. If no zone is specified, then all frozen zones are enabled\&. This causes the server to reload the zone from disk, and re\-enables dynamic updates after the load has completed\&. After a zone is thawed, dynamic updates will no longer be refused\&. If the zone has changed and the \fBixfr\-from\-differences\fR -option is in use, then the journal file will be updated to reflect changes in the zone. Otherwise, if the zone has changed, any existing journal file will be removed. +option is in use, then the journal file will be updated to reflect changes in the zone\&. Otherwise, if the zone has changed, any existing journal file will be removed\&. .sp See also -\fBrndc freeze\fR. +\fBrndc freeze\fR\&. .RE .PP \fBtrace\fR .RS 4 -Increment the servers debugging level by one. +Increment the servers debugging level by one\&. .RE .PP \fBtrace \fR\fB\fIlevel\fR\fR .RS 4 -Sets the server's debugging level to an explicit value. +Sets the server\*(Aqs debugging level to an explicit value\&. .sp See also -\fBrndc notrace\fR. +\fBrndc notrace\fR\&. .RE .PP \fBtsig\-delete\fR \fIkeyname\fR [\fIview\fR] .RS 4 -Delete a given TKEY\-negotiated key from the server. (This does not apply to statically configured TSIG keys.) +Delete a given TKEY\-negotiated key from the server\&. (This does not apply to statically configured TSIG keys\&.) .RE .PP \fBtsig\-list\fR .RS 4 List the names of all TSIG keys currently configured for use by \fBnamed\fR -in each view. The list both statically configured keys and dynamic TKEY\-negotiated keys. +in each view\&. The list both statically configured keys and dynamic TKEY\-negotiated keys\&. .RE .PP -\fBvalidation ( on | off | check ) \fR\fB[\fIview ...\fR]\fR\fB \fR +\fBvalidation ( on | off | check ) \fR\fB[\fIview \&.\&.\&.\fR]\fR\fB \fR .RS 4 -Enable, disable, or check the current status of DNSSEC validation. Note +Enable, disable, or check the current status of DNSSEC validation\&. Note \fBdnssec\-enable\fR also needs to be set to \fByes\fR or \fBauto\fR -to be effective. It defaults to enabled. +to be effective\&. It defaults to enabled\&. .RE .SH "LIMITATIONS" .PP There is currently no way to provide the shared secret for a \fBkey_id\fR -without using the configuration file. +without using the configuration file\&. .PP -Several error messages could be clearer. +Several error messages could be clearer\&. .SH "SEE ALSO" .PP \fBrndc.conf\fR(5), -\fBrndc\-confgen\fR(8), +\fBrndc-confgen\fR(8), \fBnamed\fR(8), \fBnamed.conf\fR(5), \fBndc\fR(8), -BIND 9 Administrator Reference Manual. +BIND 9 Administrator Reference Manual\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2013\-2015 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2013-2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/rndc/rndc.conf.5 b/contrib/bind9/bin/rndc/rndc.conf.5 index ce7b09930..1bb0ab6a8 100644 --- a/contrib/bind9/bin/rndc/rndc.conf.5 +++ b/contrib/bind9/bin/rndc/rndc.conf.5 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,33 +13,48 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: \fIrndc.conf\fR +'\" t +.\" Title: rndc.conf .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "\fIRNDC.CONF\fR" "5" "June 18, 2007" "BIND9" "BIND9" +.TH "RNDC\&.CONF" "5" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" rndc.conf \- rndc configuration file .SH "SYNOPSIS" -.HP 10 -\fBrndc.conf\fR +.HP \w'\fBrndc\&.conf\fR\ 'u +\fBrndc\&.conf\fR .SH "DESCRIPTION" .PP -\fIrndc.conf\fR +rndc\&.conf is the configuration file for -\fBrndc\fR, the BIND 9 name server control utility. This file has a similar structure and syntax to -\fInamed.conf\fR. Statements are enclosed in braces and terminated with a semi\-colon. Clauses in the statements are also semi\-colon terminated. The usual comment styles are supported: +\fBrndc\fR, the BIND 9 name server control utility\&. This file has a similar structure and syntax to +named\&.conf\&. Statements are enclosed in braces and terminated with a semi\-colon\&. Clauses in the statements are also semi\-colon terminated\&. The usual comment styles are supported: .PP C style: /* */ .PP @@ -47,129 +62,144 @@ C++ style: // to end of line .PP Unix style: # to end of line .PP -\fIrndc.conf\fR +rndc\&.conf is much simpler than -\fInamed.conf\fR. The file uses three statements: an options statement, a server statement and a key statement. +named\&.conf\&. The file uses three statements: an options statement, a server statement and a key statement\&. .PP The \fBoptions\fR -statement contains five clauses. The +statement contains five clauses\&. The \fBdefault\-server\fR -clause is followed by the name or address of a name server. This host will be used when no name server is given as an argument to -\fBrndc\fR. The +clause is followed by the name or address of a name server\&. This host will be used when no name server is given as an argument to +\fBrndc\fR\&. The \fBdefault\-key\fR clause is followed by the name of a key which is identified by a \fBkey\fR -statement. If no +statement\&. If no \fBkeyid\fR is provided on the rndc command line, and no \fBkey\fR clause is found in a matching \fBserver\fR -statement, this default key will be used to authenticate the server's commands and responses. The +statement, this default key will be used to authenticate the server\*(Aqs commands and responses\&. The \fBdefault\-port\fR -clause is followed by the port to connect to on the remote name server. If no +clause is followed by the port to connect to on the remote name server\&. If no \fBport\fR option is provided on the rndc command line, and no \fBport\fR clause is found in a matching \fBserver\fR -statement, this default port will be used to connect. The +statement, this default port will be used to connect\&. The \fBdefault\-source\-address\fR and \fBdefault\-source\-address\-v6\fR -clauses which can be used to set the IPv4 and IPv6 source addresses respectively. +clauses which can be used to set the IPv4 and IPv6 source addresses respectively\&. .PP After the \fBserver\fR -keyword, the server statement includes a string which is the hostname or address for a name server. The statement has three possible clauses: +keyword, the server statement includes a string which is the hostname or address for a name server\&. The statement has three possible clauses: \fBkey\fR, \fBport\fR and -\fBaddresses\fR. The key name must match the name of a key statement in the file. The port number specifies the port to connect to. If an +\fBaddresses\fR\&. The key name must match the name of a key statement in the file\&. The port number specifies the port to connect to\&. If an \fBaddresses\fR -clause is supplied these addresses will be used instead of the server name. Each address can take an optional port. If an +clause is supplied these addresses will be used instead of the server name\&. Each address can take an optional port\&. If an \fBsource\-address\fR or \fBsource\-address\-v6\fR -of supplied then these will be used to specify the IPv4 and IPv6 source addresses respectively. +of supplied then these will be used to specify the IPv4 and IPv6 source addresses respectively\&. .PP The \fBkey\fR -statement begins with an identifying string, the name of the key. The statement has two clauses. +statement begins with an identifying string, the name of the key\&. The statement has two clauses\&. \fBalgorithm\fR identifies the encryption algorithm for \fBrndc\fR -to use; currently only HMAC\-MD5 is supported. This is followed by a secret clause which contains the base\-64 encoding of the algorithm's encryption key. The base\-64 string is enclosed in double quotes. +to use; currently only HMAC\-MD5 is supported\&. This is followed by a secret clause which contains the base\-64 encoding of the algorithm\*(Aqs encryption key\&. The base\-64 string is enclosed in double quotes\&. .PP -There are two common ways to generate the base\-64 string for the secret. The BIND 9 program +There are two common ways to generate the base\-64 string for the secret\&. The BIND 9 program \fBrndc\-confgen\fR can be used to generate a random key, or the \fBmmencode\fR program, also known as -\fBmimencode\fR, can be used to generate a base\-64 string from known input. +\fBmimencode\fR, can be used to generate a base\-64 string from known input\&. \fBmmencode\fR -does not ship with BIND 9 but is available on many systems. See the EXAMPLE section for sample command lines for each. +does not ship with BIND 9 but is available on many systems\&. See the EXAMPLE section for sample command lines for each\&. .SH "EXAMPLE" .PP +.if n \{\ .RS 4 +.\} .nf options { default\-server localhost; default\-key samplekey; }; .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf server localhost { key samplekey; }; .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf server testserver { key testkey; addresses { localhost port 5353; }; }; .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf key samplekey { algorithm hmac\-md5; secret "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz"; }; .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf key testkey { algorithm hmac\-md5; secret "R3HI8P6BKw9ZwXwN3VZKuQ=="; }; .fi +.if n \{\ .RE -.sp +.\} .PP In the above example, \fBrndc\fR -will by default use the server at localhost (127.0.0.1) and the key called samplekey. Commands to the localhost server will use the samplekey key, which must also be defined in the server's configuration file with the same name and secret. The key statement indicates that samplekey uses the HMAC\-MD5 algorithm and its secret clause contains the base\-64 encoding of the HMAC\-MD5 secret enclosed in double quotes. +will by default use the server at localhost (127\&.0\&.0\&.1) and the key called samplekey\&. Commands to the localhost server will use the samplekey key, which must also be defined in the server\*(Aqs configuration file with the same name and secret\&. The key statement indicates that samplekey uses the HMAC\-MD5 algorithm and its secret clause contains the base\-64 encoding of the HMAC\-MD5 secret enclosed in double quotes\&. .PP If \fBrndc \-s testserver\fR is used then \fBrndc\fR -will connect to server on localhost port 5353 using the key testkey. +will connect to server on localhost port 5353 using the key testkey\&. .PP To generate a random secret with \fBrndc\-confgen\fR: @@ -177,14 +207,14 @@ To generate a random secret with \fBrndc\-confgen\fR .PP A complete -\fIrndc.conf\fR -file, including the randomly generated key, will be written to the standard output. Commented\-out +rndc\&.conf +file, including the randomly generated key, will be written to the standard output\&. Commented\-out \fBkey\fR and \fBcontrols\fR statements for -\fInamed.conf\fR -are also printed. +named\&.conf +are also printed\&. .PP To generate a base\-64 secret with \fBmmencode\fR: @@ -193,22 +223,23 @@ To generate a base\-64 secret with .SH "NAME SERVER CONFIGURATION" .PP The name server must be configured to accept rndc connections and to recognize the key specified in the -\fIrndc.conf\fR +rndc\&.conf file, using the controls statement in -\fInamed.conf\fR. See the sections on the +named\&.conf\&. See the sections on the \fBcontrols\fR -statement in the BIND 9 Administrator Reference Manual for details. +statement in the BIND 9 Administrator Reference Manual for details\&. .SH "SEE ALSO" .PP \fBrndc\fR(8), -\fBrndc\-confgen\fR(8), +\fBrndc-confgen\fR(8), \fBmmencode\fR(1), -BIND 9 Administrator Reference Manual. +BIND 9 Administrator Reference Manual\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/bin/rndc/rndc.conf.docbook b/contrib/bind9/bin/rndc/rndc.conf.docbook index 8dcdef819..4cb5d40b6 100644 --- a/contrib/bind9/bin/rndc/rndc.conf.docbook +++ b/contrib/bind9/bin/rndc/rndc.conf.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -40,6 +42,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -50,13 +53,13 @@ - + rndc.conf - - DESCRIPTION + DESCRIPTION + rndc.conf is the configuration file for rndc, the BIND 9 name server control utility. This file has a similar structure and syntax to @@ -139,10 +142,10 @@ ship with BIND 9 but is available on many systems. See the EXAMPLE section for sample command lines for each. - + + + EXAMPLE - - EXAMPLE options { @@ -211,10 +214,10 @@ echo "known plaintext for a secret" | mmencode - + + + NAME SERVER CONFIGURATION - - NAME SERVER CONFIGURATION The name server must be configured to accept rndc connections and to recognize the key specified in the rndc.conf @@ -222,10 +225,10 @@ See the sections on the statement in the BIND 9 Administrator Reference Manual for details. - + + + SEE ALSO - - SEE ALSO rndc8 , @@ -237,16 +240,6 @@ , BIND 9 Administrator Reference Manual. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/rndc/rndc.conf.html b/contrib/bind9/bin/rndc/rndc.conf.html index 5b33584b9..46fab0855 100644 --- a/contrib/bind9/bin/rndc/rndc.conf.html +++ b/contrib/bind9/bin/rndc/rndc.conf.html @@ -1,5 +1,5 @@ - rndc.conf - + -

    +

    Name

    @@ -31,10 +30,10 @@

    Synopsis

    rndc.conf

    -
    -

    DESCRIPTION

    +
    +

    DESCRIPTION

    rndc.conf is the configuration file - for rndc, the BIND 9 name server control + for rndc, the BIND 9 name server control utility. This file has a similar structure and syntax to named.conf. Statements are enclosed in braces and terminated with a semi-colon. Clauses in @@ -60,7 +59,7 @@ The default-server clause is followed by the name or address of a name server. This host will be used when no name server is given as an argument to - rndc. The default-key + rndc. The default-key clause is followed by the name of a key which is identified by a key statement. If no keyid is provided on the rndc command line, @@ -96,7 +95,7 @@ The key statement begins with an identifying string, the name of the key. The statement has two clauses. algorithm identifies the encryption algorithm - for rndc to use; currently only HMAC-MD5 + for rndc to use; currently only HMAC-MD5 is supported. This is followed by a secret clause which contains the base-64 encoding of the algorithm's encryption key. The @@ -104,20 +103,20 @@

    There are two common ways to generate the base-64 string for the - secret. The BIND 9 program rndc-confgen + secret. The BIND 9 program rndc-confgen can be used to generate a random key, or the - mmencode program, also known as - mimencode, can be used to generate a + mmencode program, also known as + mimencode, can be used to generate a base-64 - string from known input. mmencode does + string from known input. mmencode does not ship with BIND 9 but is available on many systems. See the EXAMPLE section for sample command lines for each.

    -
    -

    EXAMPLE

    +
    +

    EXAMPLE

           options {
         default-server  localhost;
@@ -158,7 +157,7 @@
 
    
     
    
 
    
-      In the above example, rndc will by
+      In the above example, rndc will by
       default use
       the server at localhost (127.0.0.1) and the key called samplekey.
       Commands to the localhost server will use the samplekey key, which
@@ -168,11 +167,11 @@
       base-64 encoding of the HMAC-MD5 secret enclosed in double quotes.
     
    
 
    
-      If rndc -s testserver is used then rndc will
+      If rndc -s testserver is used then rndc will
       connect to server on localhost port 5353 using the key testkey.
     
    
 
    
-      To generate a random secret with rndc-confgen:
+      To generate a random secret with rndc-confgen:
     
    
 
    rndc-confgen
     
    
@@ -185,13 +184,13 @@
       named.conf are also printed.
     
    
 
    
-      To generate a base-64 secret with mmencode:
+      To generate a base-64 secret with mmencode:
     
    
 
    echo "known plaintext for a secret" | mmencode
    -
    -

    NAME SERVER CONFIGURATION

    +
    +

    NAME SERVER CONFIGURATION

    The name server must be configured to accept rndc connections and to recognize the key specified in the rndc.conf @@ -200,18 +199,13 @@ BIND 9 Administrator Reference Manual for details.

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    rndc(8), rndc-confgen(8), mmencode(1), BIND 9 Administrator Reference Manual.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/rndc/rndc.docbook b/contrib/bind9/bin/rndc/rndc.docbook index 141ce5f37..913e11b9d 100644 --- a/contrib/bind9/bin/rndc/rndc.docbook +++ b/contrib/bind9/bin/rndc/rndc.docbook @@ -1,6 +1,3 @@ -]> - + + + + 2013-12-04 + - December 04, 2013 + ISC + Internet Systems Consortium, Inc. @@ -52,21 +54,21 @@ - + rndc - - - - - - - - command + + + + + + + + command - - DESCRIPTION + DESCRIPTION + rndc controls the operation of a name server. It supersedes the ndc utility @@ -93,10 +95,10 @@ determine how to contact the name server and decide what algorithm and key it should use. - + + + OPTIONS - - OPTIONS @@ -196,10 +198,10 @@ - + + + COMMANDS - - COMMANDS A list of commands supported by rndc can be seen by running rndc without arguments. @@ -258,7 +260,7 @@ Delete a zone while the server is running. Only zones that were originally added via rndc addzone can be deleted - in this manner. + in this manner. See also rndc addzone @@ -506,7 +508,7 @@ Fetch all DNSSEC keys for the given zone - from the key directory (see the + from the key directory (see the key-directory option in the BIND 9 Administrator Reference Manual). If they are within their publication period, merge them into the @@ -539,7 +541,7 @@ operations (such as signing or generating NSEC3 chains) is stored in the zone in the form of DNS resource records of type - sig-signing-type. + sig-signing-type. rndc signing -list converts these records into a human-readable form, indicating which keys are currently signing @@ -565,7 +567,7 @@ flags, iterations, and salt, in that order. - Currently, the only defined value for hash algorithm + Currently, the only defined value for hash algorithm is 1, representing SHA-1. The may be set to 0 or 1, @@ -726,10 +728,10 @@ - + + + LIMITATIONS - - LIMITATIONS There is currently no way to provide the shared secret for a without using the configuration file. @@ -737,10 +739,10 @@ Several error messages could be clearer. - + + + SEE ALSO - - SEE ALSO rndc.conf5 , @@ -758,16 +760,6 @@ , BIND 9 Administrator Reference Manual. - - - - AUTHOR - Internet Systems Consortium - - + - + diff --git a/contrib/bind9/bin/rndc/rndc.html b/contrib/bind9/bin/rndc/rndc.html index 0daea8a28..7aa8f6cc9 100644 --- a/contrib/bind9/bin/rndc/rndc.html +++ b/contrib/bind9/bin/rndc/rndc.html @@ -14,14 +14,13 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - rndc - + -
    +

    Name

    @@ -31,22 +30,22 @@

    Synopsis

    rndc [-b source-address] [-c config-file] [-k key-file] [-s server] [-p port] [-V] [-y key_id] {command}

    -
    -

    DESCRIPTION

    -

    rndc +

    +

    DESCRIPTION

    +

    rndc controls the operation of a name - server. It supersedes the ndc utility + server. It supersedes the ndc utility that was provided in old BIND releases. If - rndc is invoked with no command line + rndc is invoked with no command line options or arguments, it prints a short summary of the supported commands and the available options and their arguments.

    -

    rndc +

    rndc communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of - rndc and named, + rndc and named, the only supported authentication algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command @@ -54,15 +53,15 @@ over the channel must be signed by a key_id known to the server.

    -

    rndc +

    rndc reads a configuration file to determine how to contact the name server and decide what algorithm and key it should use.

    -
    -

    OPTIONS

    -
    +
    +

    OPTIONS

    +
    -b source-address

    Use source-address @@ -90,9 +89,9 @@

    server is the name or address of the server which matches a server statement in the configuration file for - rndc. If no server is supplied on the + rndc. If no server is supplied on the command line, the host named by the default-server clause - in the options statement of the rndc + in the options statement of the rndc configuration file will be used.

    -p port
    @@ -112,10 +111,10 @@ from the configuration file. key_id must be - known by named with the same algorithm and secret string + known by named with the same algorithm and secret string in order for control message validation to succeed. If no key_id - is specified, rndc will first look + is specified, rndc will first look for a key clause in the server statement of the server being used, or if no server statement is present for that host, then the default-key clause of the options statement. @@ -126,22 +125,22 @@

    -
    -

    COMMANDS

    +
    +

    COMMANDS

    - A list of commands supported by rndc can - be seen by running rndc without arguments. + A list of commands supported by rndc can + be seen by running rndc without arguments.

    Currently supported commands are:

    -
    +
    addzone zone [class [view]] configuration

    Add a zone while the server is running. This command requires the - allow-new-zones option to be set + allow-new-zones option to be set to yes. The configuration string specified on the command line is the zone @@ -153,13 +152,13 @@ hash.nzf, where hash is a cryptographic hash generated from the name of - the view. When named is + the view. When named is restarted, the file will be loaded into the view configuration, so that zones that were added can persist after a restart.

    - This sample addzone command + This sample addzone command would add the zone example.com to the default view:

    @@ -171,7 +170,7 @@ configuration text.)

    - See also rndc delzone. + See also rndc delzone.

    delzone zone [class [view]]
    @@ -179,11 +178,11 @@

    Delete a zone while the server is running. Only zones that were originally added via - rndc addzone can be deleted - in this manner. + rndc addzone can be deleted + in this manner.

    - See also rndc addzone + See also rndc addzone

    dumpdb [-all|-cache|-zone|-adb|-bad] [view ...]
    @@ -193,7 +192,7 @@ dump file for the specified views. If no view is specified, all views are dumped. - (See the dump-file option in + (See the dump-file option in the BIND 9 Administrator Reference Manual.)

    flush
    @@ -225,7 +224,7 @@ the zone is frozen.

    - See also rndc thaw. + See also rndc thaw.

    halt [-p]
    @@ -235,12 +234,12 @@ made through dynamic update or IXFR are not saved to the master files, but will be rolled forward from the journal files when the server is restarted. - If -p is specified named's process id is returned. - This allows an external process to determine when named + If -p is specified named's process id is returned. + This allows an external process to determine when named had completed halting.

    - See also rndc stop. + See also rndc stop.

    loadkeys zone [class [view]]
    @@ -249,14 +248,14 @@ Fetch all DNSSEC keys for the given zone from the key directory. If they are within their publication period, merge them into the - zone's DNSKEY RRset. Unlike rndc + zone's DNSKEY RRset. Unlike rndc sign, however, the zone is not immediately re-signed by the new keys, but is allowed to incrementally re-sign over time.

    This command requires that the - auto-dnssec zone option + auto-dnssec zone option be set to maintain, and also requires the zone to be configured to allow dynamic DNS. @@ -274,7 +273,7 @@ Sets the server's debugging level to 0.

    - See also rndc trace. + See also rndc trace.

    querylog [on|off]
    @@ -286,13 +285,13 @@

    Query logging can also be enabled - by explicitly directing the queries - category to a - channel in the - logging section of + by explicitly directing the queries + category to a + channel in the + logging section of named.conf or by specifying - querylog yes; in the - options section of + querylog yes; in the + options section of named.conf.

    @@ -301,14 +300,14 @@ Reload the configuration file and load new zones, but do not reload existing zone files even if they have changed. - This is faster than a full reload when there + This is faster than a full reload when there is a large number of zones because it avoids the need to examine the modification times of the zones files.

    recursing

    - Dump the list of queries named is currently + Dump the list of queries named is currently recursing on, and the list of domains to which iterative queries are currently being sent. (The second list includes the number of fetches currently active for the given domain, @@ -334,7 +333,7 @@

    If the zone is configured to use - inline-signing, the signed + inline-signing, the signed version of the zone is discarded; after the retransfer of the unsigned version is complete, the signed version will be regenerated with all new @@ -352,8 +351,8 @@

    Fetch all DNSSEC keys for the given zone - from the key directory (see the - key-directory option in + from the key directory (see the + key-directory option in the BIND 9 Administrator Reference Manual). If they are within their publication period, merge them into the zone's DNSKEY RRset. If the DNSKEY RRset @@ -362,7 +361,7 @@

    This command requires that the - auto-dnssec zone option be set + auto-dnssec zone option be set to allow or maintain, and also requires the zone to be configured to @@ -371,7 +370,7 @@ Reference Manual for more details.)

    - See also rndc loadkeys. + See also rndc loadkeys.

    signing [( -list | -clear keyid/algorithm | -clear all | -nsec3param ( parameters | none ) ) ] zone [class [view]]
    @@ -382,33 +381,33 @@ operations (such as signing or generating NSEC3 chains) is stored in the zone in the form of DNS resource records of type - sig-signing-type. - rndc signing -list converts + sig-signing-type. + rndc signing -list converts these records into a human-readable form, indicating which keys are currently signing or have finished signing the zone, and which NSEC3 chains are being created or removed.

    - rndc signing -clear can remove + rndc signing -clear can remove a single key (specified in the same format that - rndc signing -list uses to + rndc signing -list uses to display it), or all keys. In either case, only completed keys are removed; any record indicating that a key has not yet finished signing the zone will be retained.

    - rndc signing -nsec3param sets + rndc signing -nsec3param sets the NSEC3 parameters for a zone. This is the only supported mechanism for using NSEC3 with - inline-signing zones. + inline-signing zones. Parameters are specified in the same format as an NSEC3PARAM resource record: hash algorithm, flags, iterations, and salt, in that order.

    - Currently, the only defined value for hash algorithm + Currently, the only defined value for hash algorithm is 1, representing SHA-1. The flags may be set to 0 or 1, @@ -424,13 +423,13 @@ So, for example, to create an NSEC3 chain using the SHA-1 hash algorithm, no opt-out flag, 10 iterations, and a salt value of "FFFF", use: - rndc signing -nsec3param 1 0 10 FFFF zone. + rndc signing -nsec3param 1 0 10 FFFF zone. To set the opt-out flag, 15 iterations, and no salt, use: - rndc signing -nsec3param 1 1 15 - zone. + rndc signing -nsec3param 1 1 15 - zone.

    - rndc signing -nsec3param none + rndc signing -nsec3param none removes an existing NSEC3 chain and replaces it with NSEC.

    @@ -438,14 +437,14 @@
    stats

    Write server statistics to the statistics file. - (See the statistics-file option in + (See the statistics-file option in the BIND 9 Administrator Reference Manual.)

    status

    Display status of the server. - Note that the number of zones includes the internal bind/CH zone - and the default ./IN + Note that the number of zones includes the internal bind/CH zone + and the default ./IN hint zone if there is not an explicit root zone configured.

    @@ -455,11 +454,11 @@ Stop the server, making sure any recent changes made through dynamic update or IXFR are first saved to the master files of the updated zones. - If -p is specified named's process id is returned. - This allows an external process to determine when named + If -p is specified named's process id is returned. + This allows an external process to determine when named had completed stopping.

    -

    See also rndc halt.

    +

    See also rndc halt.

    sync [-clean] [zone [class [view]]]

    @@ -478,13 +477,13 @@ load has completed. After a zone is thawed, dynamic updates will no longer be refused. If the zone has changed and the - ixfr-from-differences option is + ixfr-from-differences option is in use, then the journal file will be updated to reflect changes in the zone. Otherwise, if the zone has changed, any existing journal file will be removed.

    -

    See also rndc freeze.

    +

    See also rndc freeze.

    trace

    @@ -497,7 +496,7 @@ value.

    - See also rndc notrace. + See also rndc notrace.

    tsig-delete keyname [view]
    @@ -509,7 +508,7 @@
    tsig-list

    List the names of all TSIG keys currently configured - for use by named in each view. The + for use by named in each view. The list both statically configured keys and dynamic TKEY-negotiated keys.

    @@ -517,15 +516,15 @@

    Enable, disable, or check the current status of DNSSEC validation. - Note dnssec-enable also needs to be + Note dnssec-enable also needs to be set to yes or auto to be effective. It defaults to enabled.

    -
    -

    LIMITATIONS

    +
    +

    LIMITATIONS

    There is currently no way to provide the shared secret for a key_id without using the configuration file. @@ -534,8 +533,8 @@ Several error messages could be clearer.

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    rndc.conf(5), rndc-confgen(8), named(8), @@ -544,10 +543,5 @@ BIND 9 Administrator Reference Manual.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/tools/Makefile.in b/contrib/bind9/bin/tools/Makefile.in index a3960051c..0255a6240 100644 --- a/contrib/bind9/bin/tools/Makefile.in +++ b/contrib/bind9/bin/tools/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2010, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2010, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -12,8 +12,6 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.13 2010/01/07 23:48:53 tbox Exp $ - srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ @@ -40,7 +38,7 @@ LWRESDEPLIBS = ../../lib/lwres/liblwres.@A@ LIBS = ${ISCLIBS} @LIBS@ NOSYMLIBS = ${ISCNOSYMLIBS} @LIBS@ -SUBDIRS = +SUBDIRS = TARGETS = arpaname@EXEEXT@ named-journalprint@EXEEXT@ nsec3hash@EXEEXT@ \ genrandom@EXEEXT@ isc-hmac-fixup@EXEEXT@ diff --git a/contrib/bind9/bin/tools/arpaname.1 b/contrib/bind9/bin/tools/arpaname.1 index d8a43171f..d5bb1b5af 100644 --- a/contrib/bind9/bin/tools/arpaname.1 +++ b/contrib/bind9/bin/tools/arpaname.1 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,37 +12,53 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: arpaname .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: March 03, 2009 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2009-03-03 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "ARPANAME" "1" "March 03, 2009" "BIND9" "BIND9" +.TH "ARPANAME" "1" "2009\-03\-03" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" arpaname \- translate IP addresses to the corresponding ARPA names .SH "SYNOPSIS" -.HP 9 +.HP \w'\fBarpaname\fR\ 'u \fBarpaname\fR {\fIipaddress\ \fR...} .SH "DESCRIPTION" .PP \fBarpaname\fR -translates IP addresses (IPv4 and IPv6) to the corresponding IN\-ADDR.ARPA or IP6.ARPA names. +translates IP addresses (IPv4 and IPv6) to the corresponding IN\-ADDR\&.ARPA or IP6\&.ARPA names\&. .SH "SEE ALSO" .PP -BIND 9 Administrator Reference Manual. +BIND 9 Administrator Reference Manual\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/tools/arpaname.docbook b/contrib/bind9/bin/tools/arpaname.docbook index 04fd54aec..a0651f3e4 100644 --- a/contrib/bind9/bin/tools/arpaname.docbook +++ b/contrib/bind9/bin/tools/arpaname.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2009-03-03 + - March 03, 2009 + ISC + Internet Systems Consortium, Inc. - arpaname 1 @@ -37,40 +38,31 @@ 2009 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") - + arpaname ipaddress - - DESCRIPTION + DESCRIPTION + arpaname translates IP addresses (IPv4 and IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names. - + + + SEE ALSO - - SEE ALSO BIND 9 Administrator Reference Manual. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/tools/arpaname.html b/contrib/bind9/bin/tools/arpaname.html index 29ea03b51..b54ddd161 100644 --- a/contrib/bind9/bin/tools/arpaname.html +++ b/contrib/bind9/bin/tools/arpaname.html @@ -1,5 +1,5 @@ - arpaname - + -
    +

    Name

    @@ -30,23 +29,18 @@

    Synopsis

    arpaname {ipaddress ...}

    -
    -

    DESCRIPTION

    +
    +

    DESCRIPTION

    - arpaname translates IP addresses (IPv4 and + arpaname translates IP addresses (IPv4 and IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    BIND 9 Administrator Reference Manual.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/tools/genrandom.8 b/contrib/bind9/bin/tools/genrandom.8 index 30d50d7ea..d51956b32 100644 --- a/contrib/bind9/bin/tools/genrandom.8 +++ b/contrib/bind9/bin/tools/genrandom.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2009-2011, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2009-2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,31 +12,46 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: genrandom .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: August 08, 2011 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2011-08-08 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "GENRANDOM" "8" "August 08, 2011" "BIND9" "BIND9" +.TH "GENRANDOM" "8" "2011\-08\-08" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" genrandom \- generate a file containing random data .SH "SYNOPSIS" -.HP 10 +.HP \w'\fBgenrandom\fR\ 'u \fBgenrandom\fR [\fB\-n\ \fR\fB\fInumber\fR\fR] {\fIsize\fR} {\fIfilename\fR} .SH "DESCRIPTION" .PP \fBgenrandom\fR -generates a file or a set of files containing a specified quantity of pseudo\-random data, which can be used as a source of entropy for other commands on systems with no random device. +generates a file or a set of files containing a specified quantity of pseudo\-random data, which can be used as a source of entropy for other commands on systems with no random device\&. .SH "ARGUMENTS" .PP \-n \fInumber\fR @@ -45,17 +60,17 @@ In place of generating one file, generates \fBnumber\fR (from 2 to 9) files, appending \fBnumber\fR -to the name. +to the name\&. .RE .PP size .RS 4 -The size of the file, in kilobytes, to generate. +The size of the file, in kilobytes, to generate\&. .RE .PP filename .RS 4 -The file name into which random data should be written. +The file name into which random data should be written\&. .RE .SH "SEE ALSO" .PP @@ -63,7 +78,8 @@ The file name into which random data should be written. \fBarc4random\fR(3) .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2009\-2011, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2009-2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/tools/genrandom.docbook b/contrib/bind9/bin/tools/genrandom.docbook index ecc206a54..a79926c82 100644 --- a/contrib/bind9/bin/tools/genrandom.docbook +++ b/contrib/bind9/bin/tools/genrandom.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2011-08-08 + - August 08, 2011 + ISC + Internet Systems Consortium, Inc. @@ -39,31 +41,32 @@ 2010 2011 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") - + genrandom - - size - filename + + size + filename - - DESCRIPTION + DESCRIPTION + genrandom generates a file or a set of files containing a specified quantity of pseudo-random data, which can be used as a source of entropy for other commands on systems with no random device. - + + + ARGUMENTS - - ARGUMENTS -n number @@ -93,10 +96,10 @@ - + + + SEE ALSO - - SEE ALSO rand3 @@ -105,16 +108,6 @@ arc4random3 - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/tools/genrandom.html b/contrib/bind9/bin/tools/genrandom.html index e125a0120..f61f57a38 100644 --- a/contrib/bind9/bin/tools/genrandom.html +++ b/contrib/bind9/bin/tools/genrandom.html @@ -1,5 +1,5 @@ - genrandom - + -
    +

    Name

    @@ -30,18 +29,18 @@

    Synopsis

    genrandom [-n number] {size} {filename}

    -
    -

    DESCRIPTION

    +
    +

    DESCRIPTION

    - genrandom + genrandom generates a file or a set of files containing a specified quantity of pseudo-random data, which can be used as a source of entropy for other commands on systems with no random device.

    -
    -

    ARGUMENTS

    -
    +
    +

    ARGUMENTS

    +
    -n number

    In place of generating one file, generates number @@ -57,17 +56,12 @@

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    rand(3), arc4random(3)

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/tools/isc-hmac-fixup.8 b/contrib/bind9/bin/tools/isc-hmac-fixup.8 index 1b842fbd0..0f6079104 100644 --- a/contrib/bind9/bin/tools/isc-hmac-fixup.8 +++ b/contrib/bind9/bin/tools/isc-hmac-fixup.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2010, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2010, 2013-2015 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,50 +12,66 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: isc\-hmac\-fixup +'\" t +.\" Title: isc-hmac-fixup .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: April 28, 2013 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2013-04-28 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "ISC\-HMAC\-FIXUP" "8" "April 28, 2013" "BIND9" "BIND9" +.TH "ISC\-HMAC\-FIXUP" "8" "2013\-04\-28" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -isc\-hmac\-fixup \- fixes HMAC keys generated by older versions of BIND +isc-hmac-fixup \- fixes HMAC keys generated by older versions of BIND .SH "SYNOPSIS" -.HP 15 +.HP \w'\fBisc\-hmac\-fixup\fR\ 'u \fBisc\-hmac\-fixup\fR {\fIalgorithm\fR} {\fIsecret\fR} .SH "DESCRIPTION" .PP -Versions of BIND 9 up to and including BIND 9.6 had a bug causing HMAC\-SHA* TSIG keys which were longer than the digest length of the hash algorithm (i.e., SHA1 keys longer than 160 bits, SHA256 keys longer than 256 bits, etc) to be used incorrectly, generating a message authentication code that was incompatible with other DNS implementations. +Versions of BIND 9 up to and including BIND 9\&.6 had a bug causing HMAC\-SHA* TSIG keys which were longer than the digest length of the hash algorithm (i\&.e\&., SHA1 keys longer than 160 bits, SHA256 keys longer than 256 bits, etc) to be used incorrectly, generating a message authentication code that was incompatible with other DNS implementations\&. .PP -This bug has been fixed in BIND 9.7. However, the fix may cause incompatibility between older and newer versions of BIND, when using long keys. +This bug has been fixed in BIND 9\&.7\&. However, the fix may cause incompatibility between older and newer versions of BIND, when using long keys\&. \fBisc\-hmac\-fixup\fR -modifies those keys to restore compatibility. +modifies those keys to restore compatibility\&. .PP To modify a key, run \fBisc\-hmac\-fixup\fR -and specify the key's algorithm and secret on the command line. If the secret is longer than the digest length of the algorithm (64 bytes for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a new secret will be generated consisting of a hash digest of the old secret. (If the secret did not require conversion, then it will be printed without modification.) +and specify the key\*(Aqs algorithm and secret on the command line\&. If the secret is longer than the digest length of the algorithm (64 bytes for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a new secret will be generated consisting of a hash digest of the old secret\&. (If the secret did not require conversion, then it will be printed without modification\&.) .SH "SECURITY CONSIDERATIONS" .PP Secrets that have been converted by \fBisc\-hmac\-fixup\fR -are shortened, but as this is how the HMAC protocol works in operation anyway, it does not affect security. RFC 2104 notes, "Keys longer than [the digest length] are acceptable but the extra length would not significantly increase the function strength." +are shortened, but as this is how the HMAC protocol works in operation anyway, it does not affect security\&. RFC 2104 notes, "Keys longer than [the digest length] are acceptable but the extra length would not significantly increase the function strength\&." .SH "SEE ALSO" .PP BIND 9 Administrator Reference Manual, -RFC 2104. +RFC 2104\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2010, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2010, 2013-2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/tools/isc-hmac-fixup.docbook b/contrib/bind9/bin/tools/isc-hmac-fixup.docbook index 986c30b85..931086348 100644 --- a/contrib/bind9/bin/tools/isc-hmac-fixup.docbook +++ b/contrib/bind9/bin/tools/isc-hmac-fixup.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2013-04-28 + - April 28, 2013 + ISC + Internet Systems Consortium, Inc. @@ -38,20 +40,21 @@ 2010 2013 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") - + isc-hmac-fixup - algorithm - secret + algorithm + secret - - DESCRIPTION + DESCRIPTION + Versions of BIND 9 up to and including BIND 9.6 had a bug causing HMAC-SHA* TSIG keys which were longer than the digest length of the @@ -75,10 +78,10 @@ secret. (If the secret did not require conversion, then it will be printed without modification.) - + + + SECURITY CONSIDERATIONS - - SECURITY CONSIDERATIONS Secrets that have been converted by isc-hmac-fixup are shortened, but as this is how the HMAC protocol works in @@ -87,24 +90,14 @@ extra length would not significantly increase the function strength." - + + + SEE ALSO - - SEE ALSO BIND 9 Administrator Reference Manual, RFC 2104. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/tools/isc-hmac-fixup.html b/contrib/bind9/bin/tools/isc-hmac-fixup.html index cb975589c..5bd25586f 100644 --- a/contrib/bind9/bin/tools/isc-hmac-fixup.html +++ b/contrib/bind9/bin/tools/isc-hmac-fixup.html @@ -1,5 +1,5 @@ - isc-hmac-fixup - + -
    +

    Name

    @@ -30,8 +29,8 @@

    Synopsis

    isc-hmac-fixup {algorithm} {secret}

    -
    -

    DESCRIPTION

    +
    +

    DESCRIPTION

    Versions of BIND 9 up to and including BIND 9.6 had a bug causing HMAC-SHA* TSIG keys which were longer than the digest length of the @@ -43,11 +42,11 @@

    This bug has been fixed in BIND 9.7. However, the fix may cause incompatibility between older and newer versions of - BIND, when using long keys. isc-hmac-fixup + BIND, when using long keys. isc-hmac-fixup modifies those keys to restore compatibility.

    - To modify a key, run isc-hmac-fixup and + To modify a key, run isc-hmac-fixup and specify the key's algorithm and secret on the command line. If the secret is longer than the digest length of the algorithm (64 bytes for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a @@ -56,10 +55,10 @@ printed without modification.)

    -
    -

    SECURITY CONSIDERATIONS

    +
    +

    SECURITY CONSIDERATIONS

    - Secrets that have been converted by isc-hmac-fixup + Secrets that have been converted by isc-hmac-fixup are shortened, but as this is how the HMAC protocol works in operation anyway, it does not affect security. RFC 2104 notes, "Keys longer than [the digest length] are acceptable but the @@ -67,17 +66,12 @@ strength."

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    BIND 9 Administrator Reference Manual, RFC 2104.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/tools/named-journalprint.8 b/contrib/bind9/bin/tools/named-journalprint.8 index ec91eb273..8363739c0 100644 --- a/contrib/bind9/bin/tools/named-journalprint.8 +++ b/contrib/bind9/bin/tools/named-journalprint.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,49 +12,65 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l -.\" Title: named\-journalprint +'\" t +.\" Title: named-journalprint .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: December 04, 2009 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2009-12-04 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "NAMED\-JOURNALPRINT" "8" "December 04, 2009" "BIND9" "BIND9" +.TH "NAMED\-JOURNALPRINT" "8" "2009\-12\-04" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" -named\-journalprint \- print zone journal in human\-readable form +named-journalprint \- print zone journal in human\-readable form .SH "SYNOPSIS" -.HP 19 +.HP \w'\fBnamed\-journalprint\fR\ 'u \fBnamed\-journalprint\fR {\fIjournal\fR} .SH "DESCRIPTION" .PP \fBnamed\-journalprint\fR -prints the contents of a zone journal file in a human\-readable form. +prints the contents of a zone journal file in a human\-readable form\&. .PP Journal files are automatically created by \fBnamed\fR -when changes are made to dynamic zones (e.g., by -\fBnsupdate\fR). They record each addition or deletion of a resource record, in binary format, allowing the changes to be re\-applied to the zone when the server is restarted after a shutdown or crash. By default, the name of the journal file is formed by appending the extension -\fI.jnl\fR -to the name of the corresponding zone file. +when changes are made to dynamic zones (e\&.g\&., by +\fBnsupdate\fR)\&. They record each addition or deletion of a resource record, in binary format, allowing the changes to be re\-applied to the zone when the server is restarted after a shutdown or crash\&. By default, the name of the journal file is formed by appending the extension +\&.jnl +to the name of the corresponding zone file\&. .PP \fBnamed\-journalprint\fR -converts the contents of a given journal file into a human\-readable text format. Each line begins with "add" or "del", to indicate whether the record was added or deleted, and continues with the resource record in master\-file format. +converts the contents of a given journal file into a human\-readable text format\&. Each line begins with "add" or "del", to indicate whether the record was added or deleted, and continues with the resource record in master\-file format\&. .SH "SEE ALSO" .PP \fBnamed\fR(8), \fBnsupdate\fR(8), -BIND 9 Administrator Reference Manual. +BIND 9 Administrator Reference Manual\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/tools/named-journalprint.docbook b/contrib/bind9/bin/tools/named-journalprint.docbook index 8d65c8e30..4fd019f28 100644 --- a/contrib/bind9/bin/tools/named-journalprint.docbook +++ b/contrib/bind9/bin/tools/named-journalprint.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2009-12-04 + - December 04, 2009 + ISC + Internet Systems Consortium, Inc. @@ -37,26 +39,27 @@ 2009 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") - + named-journalprint - journal + journal - - DESCRIPTION + DESCRIPTION + named-journalprint prints the contents of a zone journal file in a human-readable - form. + form. - Journal files are automatically created by named + Journal files are automatically created by named when changes are made to dynamic zones (e.g., by nsupdate). They record each addition or deletion of a resource record, in binary format, allowing the @@ -73,10 +76,10 @@ deleted, and continues with the resource record in master-file format. - + + + SEE ALSO - - SEE ALSO named8 @@ -86,16 +89,6 @@ , BIND 9 Administrator Reference Manual. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/tools/named-journalprint.html b/contrib/bind9/bin/tools/named-journalprint.html index 3e5e19f23..66b91a744 100644 --- a/contrib/bind9/bin/tools/named-journalprint.html +++ b/contrib/bind9/bin/tools/named-journalprint.html @@ -1,5 +1,5 @@ - named-journalprint - + -
    +

    Name

    @@ -30,17 +29,17 @@

    Synopsis

    named-journalprint {journal}

    -
    -

    DESCRIPTION

    +
    +

    DESCRIPTION

    - named-journalprint + named-journalprint prints the contents of a zone journal file in a human-readable - form. + form.

    - Journal files are automatically created by named + Journal files are automatically created by named when changes are made to dynamic zones (e.g., by - nsupdate). They record each addition + nsupdate). They record each addition or deletion of a resource record, in binary format, allowing the changes to be re-applied to the zone when the server is restarted after a shutdown or crash. By default, the name of @@ -49,25 +48,20 @@ zone file.

    - named-journalprint converts the contents of a given + named-journalprint converts the contents of a given journal file into a human-readable text format. Each line begins with "add" or "del", to indicate whether the record was added or deleted, and continues with the resource record in master-file format.

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    named(8), nsupdate(8), BIND 9 Administrator Reference Manual.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/bin/tools/nsec3hash.8 b/contrib/bind9/bin/tools/nsec3hash.8 index d4444ce8e..39ff3b48f 100644 --- a/contrib/bind9/bin/tools/nsec3hash.8 +++ b/contrib/bind9/bin/tools/nsec3hash.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,59 +12,75 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: nsec3hash .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: March 02, 2009 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2009-03-02 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "NSEC3HASH" "8" "March 02, 2009" "BIND9" "BIND9" +.TH "NSEC3HASH" "8" "2009\-03\-02" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" nsec3hash \- generate NSEC3 hash .SH "SYNOPSIS" -.HP 10 +.HP \w'\fBnsec3hash\fR\ 'u \fBnsec3hash\fR {\fIsalt\fR} {\fIalgorithm\fR} {\fIiterations\fR} {\fIdomain\fR} .SH "DESCRIPTION" .PP \fBnsec3hash\fR -generates an NSEC3 hash based on a set of NSEC3 parameters. This can be used to check the validity of NSEC3 records in a signed zone. +generates an NSEC3 hash based on a set of NSEC3 parameters\&. This can be used to check the validity of NSEC3 records in a signed zone\&. .SH "ARGUMENTS" .PP salt .RS 4 -The salt provided to the hash algorithm. +The salt provided to the hash algorithm\&. .RE .PP algorithm .RS 4 -A number indicating the hash algorithm. Currently the only supported hash algorithm for NSEC3 is SHA\-1, which is indicated by the number 1; consequently "1" is the only useful value for this argument. +A number indicating the hash algorithm\&. Currently the only supported hash algorithm for NSEC3 is SHA\-1, which is indicated by the number 1; consequently "1" is the only useful value for this argument\&. .RE .PP iterations .RS 4 -The number of additional times the hash should be performed. +The number of additional times the hash should be performed\&. .RE .PP domain .RS 4 -The domain name to be hashed. +The domain name to be hashed\&. .RE .SH "SEE ALSO" .PP BIND 9 Administrator Reference Manual, -RFC 5155. +RFC 5155\&. .SH "AUTHOR" .PP -Internet Systems Consortium +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2009, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/contrib/bind9/bin/tools/nsec3hash.docbook b/contrib/bind9/bin/tools/nsec3hash.docbook index 618e53a1a..2750d2218 100644 --- a/contrib/bind9/bin/tools/nsec3hash.docbook +++ b/contrib/bind9/bin/tools/nsec3hash.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2009-03-02 + - March 02, 2009 + ISC + Internet Systems Consortium, Inc. @@ -37,31 +39,32 @@ 2009 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") - + nsec3hash - salt - algorithm - iterations - domain + salt + algorithm + iterations + domain - - DESCRIPTION + DESCRIPTION + nsec3hash generates an NSEC3 hash based on a set of NSEC3 parameters. This can be used to check the validity of NSEC3 records in a signed zone. - + + + ARGUMENTS - - ARGUMENTS salt @@ -102,24 +105,14 @@ - + + + SEE ALSO - - SEE ALSO BIND 9 Administrator Reference Manual, RFC 5155. - + - - AUTHOR - Internet Systems Consortium - - - - + diff --git a/contrib/bind9/bin/tools/nsec3hash.html b/contrib/bind9/bin/tools/nsec3hash.html index acb83e6ee..e5de8fca9 100644 --- a/contrib/bind9/bin/tools/nsec3hash.html +++ b/contrib/bind9/bin/tools/nsec3hash.html @@ -1,5 +1,5 @@ - nsec3hash - + -
    +

    Name

    @@ -30,17 +29,17 @@

    Synopsis

    nsec3hash {salt} {algorithm} {iterations} {domain}

    -
    -

    DESCRIPTION

    +
    +

    DESCRIPTION

    - nsec3hash generates an NSEC3 hash based on + nsec3hash generates an NSEC3 hash based on a set of NSEC3 parameters. This can be used to check the validity of NSEC3 records in a signed zone.

    -
    -

    ARGUMENTS

    -
    +
    +

    ARGUMENTS

    +
    salt

    The salt provided to the hash algorithm. @@ -62,17 +61,12 @@

    -
    -

    SEE ALSO

    +
    +

    SEE ALSO

    BIND 9 Administrator Reference Manual, RFC 5155.

    -
    -

    AUTHOR

    -

    Internet Systems Consortium -

    -
    diff --git a/contrib/bind9/config.h.in b/contrib/bind9/config.h.in index c336ba349..3ba4094eb 100644 --- a/contrib/bind9/config.h.in +++ b/contrib/bind9/config.h.in @@ -1,6 +1,6 @@ /* config.h.in. Generated from configure.in by autoheader. */ /* - * Copyright (C) 2004, 2005, 2007, 2008, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2008, 2012, 2014, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -150,6 +150,9 @@ int sigwait(const unsigned int *set, int *sig); /* Define if threads need PTHREAD_SCOPE_SYSTEM */ #undef NEED_PTHREAD_SCOPE_SYSTEM +/* Define to 1 if you have the uname library function. */ +#undef HAVE_UNAME + /* Define if building universal (internal helper macro) */ #undef AC_APPLE_UNIVERSAL_BUILD @@ -191,6 +194,9 @@ int sigwait(const unsigned int *set, int *sig); MSVC and with C++ compilers. */ #undef FLEXIBLE_ARRAY_MEMBER +/* Define to 1 if the compiler supports __builtin_expect. */ +#undef HAVE_BUILTIN_EXPECT + /* Define to 1 if you have the `chroot' function. */ #undef HAVE_CHROOT diff --git a/contrib/bind9/configure.in b/contrib/bind9/configure.in index d89bd6e54..18d985f98 100644 --- a/contrib/bind9/configure.in +++ b/contrib/bind9/configure.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2003 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -464,6 +464,25 @@ AC_TRY_COMPILE([],[long long i = 0; return (0);], ISC_PLATFORM_HAVELONGLONG="#undef ISC_PLATFORM_HAVELONGLONG"]) AC_SUBST(ISC_PLATFORM_HAVELONGLONG) +# +# check for uname library routine +# +AC_MSG_CHECKING(for uname) +AC_TRY_COMPILE([ +#include +#include +], +[ +struct utsname uts; +uname(&uts); +printf("running on %s %s %s for %s\n", + uts.sysname, uts.release, uts.version, uts.machine); +], + [AC_MSG_RESULT(yes) + AC_DEFINE(HAVE_UNAME)], + [AC_MSG_RESULT(no) + AC_MSG_WARN([uname is not correctly supported])]) + # # check for GCC noreturn attribute # @@ -2606,10 +2625,6 @@ yes|auto) READLINE_LIB="$readline" break fi - if test "X$readline" = "X" - then - continue - fi for lib in -lterminfo -ltermcap -lncurses -lcurses do AC_MSG_NOTICE(checking for readline with $readline $lib) @@ -2622,6 +2637,10 @@ yes|auto) break fi done + if test "$ac_cv_func_readline" = "yes" + then + break + fi done LIBS="$saved_LIBS" ;; @@ -3093,7 +3112,6 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM" ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM" ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM" if test "$use_atomic" = "yes"; then - AC_MSG_CHECKING([architecture type for atomic operations]) have_atomic=yes # set default case "$host" in [i[3456]86-*]) @@ -3133,6 +3151,7 @@ if test "$use_atomic" = "yes"; then arch=noatomic ;; esac + AC_MSG_CHECKING([architecture type for atomic operations]) AC_MSG_RESULT($arch) fi @@ -3214,20 +3233,24 @@ if test "$have_atomic" = "yes"; then ISC_PLATFORM_HAVEATOMICSTORE="#define ISC_PLATFORM_HAVEATOMICSTORE 1" if test "$have_xaddq" = "yes"; then ISC_PLATFORM_HAVEXADDQ="#define ISC_PLATFORM_HAVEXADDQ 1" + ISC_PLATFORM_HAVEATOMICSTOREQ="#define ISC_PLATFORM_HAVEATOMICSTOREQ 1" else ISC_PLATFORM_HAVEXADDQ="#undef ISC_PLATFORM_HAVEXADDQ" + ISC_PLATFORM_HAVEATOMICSTOREQ="#undef ISC_PLATFORM_HAVEATOMICSTOREQ" fi else ISC_PLATFORM_HAVEXADD="#undef ISC_PLATFORM_HAVEXADD" ISC_PLATFORM_HAVECMPXCHG="#undef ISC_PLATFORM_HAVECMPXCHG" ISC_PLATFORM_HAVEATOMICSTORE="#undef ISC_PLATFORM_HAVEATOMICSTORE" ISC_PLATFORM_HAVEXADDQ="#undef ISC_PLATFORM_HAVEXADDQ" + ISC_PLATFORM_HAVEATOMICSTOREQ="#undef ISC_PLATFORM_HAVEATOMICSTOREQ" fi AC_SUBST(ISC_PLATFORM_HAVEXADD) AC_SUBST(ISC_PLATFORM_HAVEXADDQ) AC_SUBST(ISC_PLATFORM_HAVECMPXCHG) AC_SUBST(ISC_PLATFORM_HAVEATOMICSTORE) +AC_SUBST(ISC_PLATFORM_HAVEATOMICSTOREQ) AC_SUBST(ISC_PLATFORM_USEGCCASM) AC_SUBST(ISC_PLATFORM_USEOSFASM) @@ -3237,6 +3260,23 @@ AC_SUBST(ISC_PLATFORM_USEMACASM) ISC_ARCH_DIR=$arch AC_SUBST(ISC_ARCH_DIR) +# +# Check for __builtin_expect +# +AC_MSG_CHECKING([compiler support for __builtin_expect]) +AC_TRY_LINK(, [ + return (__builtin_expect(1, 1) ? 1 : 0); +], [ + have_builtin_expect=yes + AC_MSG_RESULT(yes) +], [ + have_builtin_expect=no + AC_MSG_RESULT(no) +]) +if test "$have_builtin_expect" = "yes"; then + AC_DEFINE(HAVE_BUILTIN_EXPECT, 1, [Define to 1 if the compiler supports __builtin_expect.]) +fi + # # Activate "rrset-order fixed" or not? # @@ -3371,6 +3411,9 @@ AC_SUBST(LATEX) AC_PATH_PROGS(PDFLATEX, pdflatex, pdflatex) AC_SUBST(PDFLATEX) +AC_PATH_PROGS(DBLATEX, dblatex, dblatex) +AC_SUBST(DBLATEX) + # # Look for w3m # @@ -3453,7 +3496,7 @@ AC_ARG_WITH(docbook-xsl, case "$docbook_path" in auto) AC_MSG_RESULT(auto) - docbook_xsl_trees="/usr/pkg/share/xsl/docbook /usr/local/share/xsl/docbook /usr/share/xsl/docbook /opt/local/share/xsl/docbook-xsl" + docbook_xsl_trees="/usr/pkg/share/xsl/docbook /usr/local/share/xsl/docbook-ns /usr/local/share/xsl/docbook /usr/share/xsl/docbook /opt/local/share/xsl/docbook-xsl /usr/share/xml/docbook/stylesheet/docbook-xsl" ;; *) docbook_xsl_trees="$withval" @@ -3476,41 +3519,11 @@ NOM_PATH_FILE(XSLT_DOCBOOK_MAKETOC_HTML, html/maketoc.xsl, $docbook_xsl_trees) NOM_PATH_FILE(XSLT_DOCBOOK_MAKETOC_XHTML, xhtml/maketoc.xsl, $docbook_xsl_trees) # -# Same dance for db2latex -# -# No idea where this lives except on FreeBSD. -# - -db2latex_xsl_trees="/usr/local/share" - -# -# Look for stylesheets we need. +# Same dance for dblatex # - -NOM_PATH_FILE(XSLT_DB2LATEX_STYLE, db2latex/xsl/docbook.xsl, $db2latex_xsl_trees) - -# -# Look for "admonition" image directory. Can't use NOM_PATH_FILE() -# because it's a directory, so just do the same things, inline. -# - -AC_MSG_CHECKING(for db2latex/xsl/figures) -for d in $db2latex_xsl_trees -do - dd=$d/db2latex/xsl/figures - if test -d $dd - then - XSLT_DB2LATEX_ADMONITIONS=$dd - AC_MSG_RESULT($dd) - break - fi -done -if test "X$XSLT_DB2LATEX_ADMONITIONS" = "X" -then - AC_MSG_RESULT(not found) - XSLT_DB2LATEX_ADMONITIONS=db2latex/xsl/figures -fi -AC_SUBST(XSLT_DB2LATEX_ADMONITIONS) +dblatex_xsl_trees="/usr/local/share/xml/docbook/stylesheet/dblatex /usr/pkg/share/xml/docbook/stylesheet/dblatex /usr/share/xml/docbook/stylesheet/dblatex" +NOM_PATH_FILE(XSLT_DBLATEX_STYLE, xsl/docbook.xsl, $dblatex_xsl_trees) +NOM_PATH_FILE(XSLT_DBLATEX_FASTBOOK, xsl/latex_book_fast.xsl, $dblatex_xsl_trees) # # IDN support @@ -3634,6 +3647,7 @@ AC_ARG_ENABLE(querytrace, [ --enable-querytrace enable very verbose query trace logging [[default=no]]], want_querytrace="$enableval", want_querytrace="no") +AC_MSG_CHECKING([whether to enable query trace logging]) case "$want_querytrace" in yes) AC_MSG_RESULT(yes) @@ -3686,12 +3700,14 @@ BIND9_PRODUCT="PRODUCT=\"${PRODUCT}\"" AC_SUBST(BIND9_PRODUCT) BIND9_DESCRIPTION="DESCRIPTION=\"${DESCRIPTION}\"" AC_SUBST(BIND9_DESCRIPTION) -BIND9_VERSION="VERSION=${MAJORVER}.${MINORVER}${PATCHVER:+.}${PATCHVER}${RELEASETYPE}${RELEASEVER}${EXTENSIONS}" +BIND9_VERSION="${MAJORVER}.${MINORVER}${PATCHVER:+.}${PATCHVER}${RELEASETYPE}${RELEASEVER}${EXTENSIONS}" AC_SUBST(BIND9_VERSION) BIND9_MAJOR="MAJOR=${MAJORVER}.${MINORVER}" AC_SUBST(BIND9_MAJOR) BIND9_VERSIONSTRING="${PRODUCT} ${MAJORVER}.${MINORVER}${PATCHVER:+.}${PATCHVER}${RELEASETYPE}${RELEASEVER}${EXTENSIONS}${DESCRIPTION:+ }${DESCRIPTION}" AC_SUBST(BIND9_VERSIONSTRING) +BIND9_VERSIONSHORT="${PRODUCT} ${MAJORVER}.${MINORVER}${PATCHVER:+.}${PATCHVER}${RELEASETYPE}${RELEASEVER}${EXTENSIONS}" +AC_SUBST(BIND9_VERSIONSHORT) BIND9_SRCID="SRCID=unset" if test -f "${srcdir}/srcid"; then @@ -3804,7 +3820,18 @@ if test "$dlopen" = "yes"; then SO_LD="ld" fi ;; - *-freebsd*|*-openbsd*|*-netbsd*) + *-freebsd*|*-openbsd*) + SO_CFLAGS="-fpic" + elf=`${CC} -dM -E - < /dev/null | grep __ELF__` + if test "$use_libtool" = "yes"; then + SO_LDFLAGS="-Xcompiler -shared" + SO_LD="${CC}" + else + SO_LDFLAGS="-shared" + SO_LD="${CC}" + fi + ;; + *-netbsd*) SO_CFLAGS="-fpic" SO_LDFLAGS="-Bshareable -x" SO_LD="ld" @@ -4070,17 +4097,20 @@ AC_CONFIG_FILES([ contrib/zone-edit.sh doc/Makefile doc/arm/Makefile + doc/arm/noteversion.xml + doc/arm/pkgversion.xml + doc/arm/releaseinfo.xml doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile + doc/tex/Makefile + doc/tex/armstyle.sty doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl - doc/xsl/isc-docbook-latex.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl - doc/xsl/isc-notes-latex.xsl isc-config.sh lib/Makefile lib/bind9/Makefile @@ -4171,7 +4201,10 @@ AC_ARG_WITH(make-clean, make_clean="$withval", make_clean="yes") case "$make_clean" in yes) - make clean + if test "$no_create" != "yes" + then + make clean + fi ;; esac @@ -4270,6 +4303,10 @@ if test "X$ac_unrecognized_opts" != "X"; then echo "Unrecognized options:" echo " $ac_unrecognized_opts" fi +if test "$enable_full_report" != "yes"; then + echo "------------------------------------------------------------------------" + echo "For more detail, use --enable-full-report." +fi echo "========================================================================" if test "X$USE_OPENSSL" = "X"; then diff --git a/contrib/bind9/doc/Makefile.in b/contrib/bind9/doc/Makefile.in index 29074b53f..df28cbe80 100644 --- a/contrib/bind9/doc/Makefile.in +++ b/contrib/bind9/doc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004-2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004-2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000, 2001 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -13,8 +13,6 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.11 2007/06/19 23:47:13 tbox Exp $ - # This Makefile is a placeholder. It exists merely to make # sure that its directory gets created in the object directory # tree when doing a build using separate object directories. @@ -23,7 +21,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -SUBDIRS = arm misc xsl doxygen +SUBDIRS = arm misc xsl doxygen tex TARGETS = @BIND9_MAKE_RULES@ diff --git a/contrib/bind9/doc/arm/Bv9ARM-book.xml b/contrib/bind9/doc/arm/Bv9ARM-book.xml index d46710ff4..fe479b029 100644 --- a/contrib/bind9/doc/arm/Bv9ARM-book.xml +++ b/contrib/bind9/doc/arm/Bv9ARM-book.xml @@ -1,8 +1,5 @@ -]> - - BIND 9 Administrator Reference Manual - - + + + + BIND 9 Administrator Reference Manual 2004 2005 @@ -44,11 +41,11 @@ 2003 Internet Software Consortium. - - + + + + Introduction - - Introduction The Internet Domain Name System (DNS) consists of the syntax @@ -60,8 +57,7 @@ hierarchical databases. - - Scope of Document +
    Scope of Document The Berkeley Internet Name Domain @@ -72,11 +68,11 @@ BIND version 9 software package for system administrators. - - + +
    + +
    Organization of This Document - - Organization of This Document In this document, Chapter 1 introduces the basic DNS and BIND concepts. Chapter 2 @@ -102,9 +98,8 @@ and the Domain Name System. - - - Conventions Used in This Document +
    +
    Conventions Used in This Document In this document, we use the following general typographic @@ -229,9 +224,9 @@ - - - The Domain Name System (<acronym>DNS</acronym>) +
    +
    The Domain Name System (<acronym>DNS</acronym>) + The purpose of this document is to explain the installation and upkeep of the BIND (Berkeley Internet @@ -240,8 +235,7 @@ (DNS) as they relate to BIND. - - DNS Fundamentals +
    DNS Fundamentals The Domain Name System (DNS) is a hierarchical, distributed @@ -263,8 +257,8 @@ from ISC as a separate download. - - Domains and Domain Names +
    +
    Domains and Domain Names The data stored in the DNS is identified by domain names that are organized as a tree according to @@ -312,10 +306,10 @@ the DNS protocol, please refer to the standards documents listed in . - +
    + +
    Zones - - Zones To properly operate a name server, it is important to understand the difference between a zone @@ -368,10 +362,9 @@ be a slave server for your domain, you are actually asking for slave service for some collection of zones. - +
    - - Authoritative Name Servers +
    Authoritative Name Servers Each zone is served by at least @@ -389,8 +382,7 @@ dig (). - - The Primary Master +
    The Primary Master The authoritative server where the master copy of the zone @@ -409,10 +401,10 @@ by humans at all, but may instead be the result of dynamic update operations. - +
    + +
    Slave Servers - - Slave Servers The other authoritative servers, the slave servers (also known as secondary servers) @@ -425,10 +417,9 @@ to transfer it from another slave. In other words, a slave server may itself act as a master to a subordinate slave server. - +
    - - Stealth Servers +
    Stealth Servers Usually all of the zone's authoritative servers are listed in @@ -463,12 +454,10 @@ with the outside world. - - - - +
    - Caching Name Servers +
    +
    Caching Name Servers - +
    + +
    Name Server Intensive Environment Issues - - Name Server Intensive Environment Issues For name server intensive environments, there are two alternative configurations that may be used. The first is where clients and @@ -639,10 +620,10 @@ this has the disadvantage of making many more external queries, as none of the name servers share their cached data. - +
    + +
    Supported Operating Systems - - Supported Operating Systems ISC BIND 9 compiles and runs on a large number @@ -653,21 +634,21 @@ directory of the BIND 9 source distribution. - +
    - - Name Server Configuration + Name Server Configuration + In this chapter we provide some suggested configurations along with guidelines for their use. We suggest reasonable values for certain option settings. - - Sample Configurations - - A Caching-only Name Server +
    Sample Configurations + +
    A Caching-only Name Server + The following sample configuration is appropriate for a caching-only name server for use by clients internal to a corporation. All @@ -696,10 +677,10 @@ zone "0.0.127.in-addr.arpa" { }; - +
    + +
    An Authoritative-only Name Server - - An Authoritative-only Name Server This sample configuration is for an authoritative-only server that is the master server for "example.com" @@ -745,11 +726,11 @@ zone "eng.example.com" { }; - - +
    +
    + +
    Load Balancing - - Load Balancing @@ -11115,10 +10761,10 @@ zone zone_name class - +
    + +
    Class - - Class The zone's name may optionally be followed by a class. If a class is not specified, class IN (for Internet), @@ -11137,10 +10783,9 @@ zone zone_name classCHAOS class. - - +
    - Zone Options +
    Zone Options @@ -11327,6 +10972,16 @@ zone zone_name class + + dnssec-loadkeys-interval + + + See the description of + dnssec-loadkeys-interval in . + + + + dnssec-update-mode @@ -11573,11 +11228,9 @@ zone zone_name classzone-statistics - If yes, the server will keep - statistical - information for this zone, which can be dumped to the - statistics-file defined in - the server options. + See the description of + zone-statistics in + . @@ -11811,41 +11464,9 @@ example.com. NS ns2.example.net. auto-dnssec - Zones configured for dynamic DNS may also use this - option to allow varying levels of automatic DNSSEC key - management. There are three possible settings: - - - auto-dnssec allow; permits - keys to be updated and the zone fully re-signed - whenever the user issues the command rndc sign - zonename. - - - auto-dnssec maintain; includes the - above, but also automatically adjusts the zone's DNSSEC - keys on schedule, according to the keys' timing metadata - (see and - ). The command - rndc sign - zonename causes - named to load keys from the key - repository and sign the zone with all keys that are - active. - rndc loadkeys - zonename causes - named to load keys from the key - repository and schedule key maintenance events to occur - in the future, but it does not sign the full zone - immediately. Note: once keys have been loaded for a - zone the first time, the repository will be searched - for changes periodically, regardless of whether - rndc loadkeys is used. The recheck - interval is defined by - dnssec-loadkeys-interval.) - - - The default setting is auto-dnssec off. + See the description of + auto-dnssec in + . @@ -11854,23 +11475,9 @@ example.com. NS ns2.example.net. serial-update-method - Zones configured for dynamic DNS may use this - option to set the update method that will be used for - the zone serial number in the SOA record. - - - With the default setting of - serial-update-method increment;, the - SOA serial number will be incremented by one each time - the zone is updated. - - - When set to - serial-update-method unixtime;, the - SOA serial number will be set to the number of seconds - since the UNIX epoch, unless the serial number is - already greater than or equal to that value, in which - case it is simply incremented by one. + See the description of + serial-update-method in + . @@ -11921,9 +11528,9 @@ example.com. NS ns2.example.net. - - - Dynamic Update Policies +
    +
    Dynamic Update Policies + BIND 9 supports two alternative methods of granting clients the right to perform dynamic updates to a zone, configured by the @@ -12111,7 +11718,7 @@ example.com. NS ns2.example.net. The name field is subject to DNS wildcard expansion, and this rule matches when the name being updated - name is a valid expansion of the wildcard. + is a valid expansion of the wildcard. @@ -12327,13 +11934,13 @@ example.com. NS ns2.example.net. all records associated with a name, the rules are checked for each existing record type. - - - - - Zone File - - Types of Resource Records and When to Use Them +
    +
    + +
    Zone File + +
    Types of Resource Records and When to Use Them + This section, largely borrowed from RFC 1034, describes the concept of a Resource Record (RR) and explains when each is used. @@ -12341,8 +11948,7 @@ example.com. NS ns2.example.net. identified and implemented in the DNS. These are also included. - - Resource Records +
    Resource Records A domain name identifies a node. Each node has a set of @@ -12521,6 +12127,18 @@ example.com. NS ns2.example.net. + + + + AVC + + + + + Application Visibility and Control record. + + + @@ -12587,6 +12205,19 @@ example.com. NS ns2.example.net. + + + + CSYNC + + + + + Child-to-Parent Synchronization in DNS as described + in RFC 7477. + + + @@ -12965,6 +12596,18 @@ example.com. NS ns2.example.net. + + + + NINFO + + + + + Contains zone status information. + + + @@ -13135,6 +12778,18 @@ example.com. NS ns2.example.net. + + + + RKEY + + + + + Resource key. + + + @@ -13191,6 +12846,30 @@ example.com. NS ns2.example.net. + + + + SINK + + + + + The kitchen sink record. + + + + + + + SMIMEA + + + + + The S/MIME Security Certificate Association. + + + @@ -13243,6 +12922,30 @@ example.com. NS ns2.example.net. + + + + TA + + + + + Trust Anchor. Experimental. + + + + + + + TALINK + + + + + Trust Anchor Link. Experimental. + + + @@ -13445,9 +13148,9 @@ example.com. NS ns2.example.net. frequently used as "pointers" to other data in the DNS. - - - Textual expression of RRs +
    +
    Textual expression of RRs + RRs are represented in binary form in the packets of the DNS protocol, and are usually represented in highly encoded form @@ -13644,11 +13347,10 @@ example.com. NS ns2.example.net. This example shows two addresses for XX.LCS.MIT.EDU, each of a different class. - - +
    +
    - - Discussion of MX Records +
    Discussion of MX Records As described above, domain servers store information as a @@ -13669,13 +13371,13 @@ example.com. NS ns2.example.net. chosen randomly. If no servers at a given priority are responding, the mail transport agent will fall back to the next largest priority. - Priority numbers do not have any absolute meaning — they are + Priority numbers do not have any absolute meaning — they are relevant only respective to other MX records for that domain name. The domain name given is the machine to which the mail will be delivered. It must have an associated address record - (A or AAAA) — CNAME is not sufficient. + (A or AAAA) — CNAME is not sufficient. For a given domain, if there is both a CNAME record and an @@ -13829,9 +13531,9 @@ example.com. NS ns2.example.net. any order), and if neither of those succeed, delivery to mail.backup.org will be attempted. - - - Setting TTLs +
    +
    Setting TTLs + The time-to-live of the RR field is a 32-bit integer represented in units of seconds, and is primarily used by resolvers when they @@ -13900,9 +13602,9 @@ example.com. NS ns2.example.net. All of these TTLs default to units of seconds, though units can be explicitly specified, for example, 1h30m. - - - Inverse Mapping in IPv4 +
    +
    Inverse Mapping in IPv4 + Reverse name resolution (that is, translation from IP address to name) is achieved by means of the in-addr.arpa domain @@ -13953,15 +13655,15 @@ example.com. NS ns2.example.net. The $ORIGIN lines in the examples - are for providing context to the examples only — they do not + are for providing context to the examples only — they do not necessarily appear in the actual usage. They are only used here to indicate that the example is relative to the listed origin. - - - Other Zone File Directives +
    +
    Other Zone File Directives + The Master File Format was initially defined in RFC 1035 and has subsequently been extended. While the Master File Format @@ -13974,8 +13676,8 @@ example.com. NS ns2.example.net. Master File Directives include $ORIGIN, $INCLUDE, and $TTL. - - The <command>@</command> (at-sign) +
    The <command>@</command> (at-sign) + When used in the label (or name) field, the asperand or at-sign (@) symbol represents the current origin. @@ -13983,9 +13685,9 @@ example.com. NS ns2.example.net. <zone_name> (followed by trailing dot). - - - The <command>$ORIGIN</command> Directive +
    +
    The <command>$ORIGIN</command> Directive + Syntax: $ORIGIN domain-name @@ -14015,9 +13717,9 @@ WWW CNAME MAIN-SERVER WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. - - - The <command>$INCLUDE</command> Directive +
    +
    The <command>$INCLUDE</command> Directive + Syntax: $INCLUDE filename @@ -14049,9 +13751,9 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. feature, or both. - - - The <command>$TTL</command> Directive +
    +
    The <command>$TTL</command> Directive + Syntax: $TTL default-ttl @@ -14066,10 +13768,10 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. $TTL is defined in RFC 2308. - - - - <acronym>BIND</acronym> Master File Extension: the <command>$GENERATE</command> Directive +
    +
    +
    <acronym>BIND</acronym> Master File Extension: the <command>$GENERATE</command> Directive + Syntax: $GENERATE range @@ -14267,10 +13969,10 @@ HOST-127.EXAMPLE. MX 0 . BIND 8 does not support the optional TTL and CLASS fields. - +
    + +
    Additional File Formats - - Additional File Formats In addition to the standard textual format, BIND 9 supports the ability to read or dump to zone files in @@ -14309,11 +14011,11 @@ HOST-127.EXAMPLE. MX 0 . portable backup of the file, it is recommended to convert the file to the standard textual representation. - - +
    +
    + +
    BIND9 Statistics - - BIND9 Statistics BIND 9 maintains lots of statistics information and provides several interfaces for users to @@ -14442,12 +14144,17 @@ HOST-127.EXAMPLE. MX 0 . A subset of Name Server Statistics is collected and shown per zone for which the server has the authority when zone-statistics is set to - yes. - These statistics counters are shown with their zone and view - names. - In some cases the view names are omitted for the default view. + full (or yes + for backward compatibility. See the description of + zone-statistics in + for further details. + + These statistics counters are shown with their zone and + view names. The view name is omitted when the server is + not configured with explicit views. + There are currently two user interfaces to get access to the statistics. @@ -14459,8 +14166,8 @@ HOST-127.EXAMPLE. MX 0 . (see .) - - The Statistics File +
    The Statistics File + The text format statistics dump begins with a line, like: @@ -14496,10 +14203,10 @@ HOST-127.EXAMPLE. MX 0 . --- Statistics Dump --- (973798949) - +
    + +
    Statistics Counters - - Statistics Counters The following tables summarize statistics counters that BIND 9 provides. @@ -14517,8 +14224,7 @@ HOST-127.EXAMPLE. MX 0 . BIND 8 statistics, if applicable. - - Name Server Statistics Counters +
    Name Server Statistics Counters @@ -14577,7 +14283,7 @@ HOST-127.EXAMPLE. MX 0 . ReqEdns0 - + @@ -14590,7 +14296,7 @@ HOST-127.EXAMPLE. MX 0 . ReqBadEDNSVer - + @@ -14603,7 +14309,7 @@ HOST-127.EXAMPLE. MX 0 . ReqTSIG - + @@ -14616,7 +14322,7 @@ HOST-127.EXAMPLE. MX 0 . ReqSIG0 - + @@ -14629,7 +14335,7 @@ HOST-127.EXAMPLE. MX 0 . ReqBadSIG - + @@ -14720,7 +14426,7 @@ HOST-127.EXAMPLE. MX 0 . RespTruncated - + @@ -14733,7 +14439,7 @@ HOST-127.EXAMPLE. MX 0 . RespEDNS0 - + @@ -14746,7 +14452,7 @@ HOST-127.EXAMPLE. MX 0 . RespTSIG - + @@ -14759,7 +14465,7 @@ HOST-127.EXAMPLE. MX 0 . RespSIG0 - + @@ -14772,7 +14478,7 @@ HOST-127.EXAMPLE. MX 0 . QrySuccess - + @@ -14791,7 +14497,7 @@ HOST-127.EXAMPLE. MX 0 . QryAuthAns - + @@ -14817,7 +14523,7 @@ HOST-127.EXAMPLE. MX 0 . QryReferral - + @@ -14834,7 +14540,7 @@ HOST-127.EXAMPLE. MX 0 . QryNxrrset - + @@ -14932,7 +14638,7 @@ HOST-127.EXAMPLE. MX 0 . QryDropped - + @@ -14947,7 +14653,7 @@ HOST-127.EXAMPLE. MX 0 . max-clients-per-query options (see the description about - .) + .) This corresponds to the dropped counter of previous versions of @@ -14960,7 +14666,7 @@ HOST-127.EXAMPLE. MX 0 . QryFailure - + @@ -14985,7 +14691,7 @@ HOST-127.EXAMPLE. MX 0 . XfrReqDone - + @@ -14998,7 +14704,7 @@ HOST-127.EXAMPLE. MX 0 . UpdateReqFwd - + @@ -15011,7 +14717,7 @@ HOST-127.EXAMPLE. MX 0 . UpdateRespFwd - + @@ -15024,7 +14730,7 @@ HOST-127.EXAMPLE. MX 0 . UpdateFwdFail - + @@ -15037,7 +14743,7 @@ HOST-127.EXAMPLE. MX 0 . UpdateDone - + @@ -15050,7 +14756,7 @@ HOST-127.EXAMPLE. MX 0 . UpdateFail - + @@ -15063,7 +14769,7 @@ HOST-127.EXAMPLE. MX 0 . UpdateBadPrereq - + @@ -15076,7 +14782,7 @@ HOST-127.EXAMPLE. MX 0 . RPZRewrites - + @@ -15089,7 +14795,7 @@ HOST-127.EXAMPLE. MX 0 . RateDropped - + @@ -15102,7 +14808,7 @@ HOST-127.EXAMPLE. MX 0 . RateSlipped - + @@ -15113,10 +14819,9 @@ HOST-127.EXAMPLE. MX 0 . - +
    - - Zone Maintenance Statistics Counters +
    Zone Maintenance Statistics Counters @@ -15269,10 +14974,9 @@ HOST-127.EXAMPLE. MX 0 . - +
    - - Resolver Statistics Counters +
    Resolver Statistics Counters @@ -15407,7 +15111,7 @@ HOST-127.EXAMPLE. MX 0 . EDNS0Fail - + @@ -15440,7 +15144,7 @@ HOST-127.EXAMPLE. MX 0 . Truncated - + @@ -15479,7 +15183,7 @@ HOST-127.EXAMPLE. MX 0 . QueryAbort - + @@ -15492,7 +15196,7 @@ HOST-127.EXAMPLE. MX 0 . QuerySockFail - + @@ -15508,7 +15212,7 @@ HOST-127.EXAMPLE. MX 0 . QueryTimeout - + @@ -15547,7 +15251,7 @@ HOST-127.EXAMPLE. MX 0 . GlueFetchv4Fail - + @@ -15560,7 +15264,7 @@ HOST-127.EXAMPLE. MX 0 . GlueFetchv6Fail - + @@ -15573,7 +15277,7 @@ HOST-127.EXAMPLE. MX 0 . ValAttempt - + @@ -15586,7 +15290,7 @@ HOST-127.EXAMPLE. MX 0 . ValOk - + @@ -15599,7 +15303,7 @@ HOST-127.EXAMPLE. MX 0 . ValNegOk - + @@ -15612,7 +15316,7 @@ HOST-127.EXAMPLE. MX 0 . ValFail - + @@ -15625,7 +15329,7 @@ HOST-127.EXAMPLE. MX 0 . QryRTTnn - + @@ -15655,10 +15359,9 @@ HOST-127.EXAMPLE. MX 0 . - +
    - - Socket I/O Statistics Counters +
    Socket I/O Statistics Counters Socket I/O statistics counters are defined per socket @@ -15813,9 +15516,10 @@ HOST-127.EXAMPLE. MX 0 . - - - Compatibility with <emphasis>BIND</emphasis> 8 Counters +
    + +
    Compatibility with <emphasis>BIND</emphasis> 8 Counters + Most statistics counters that were available in BIND 8 are also supported in @@ -15866,15 +15570,15 @@ HOST-127.EXAMPLE. MX 0 . - - - +
    +
    +
    - - <acronym>BIND</acronym> 9 Security Considerations - - Access Control Lists + <acronym>BIND</acronym> 9 Security Considerations + +
    Access Control Lists + Access Control Lists (ACLs) are address match lists that you can set up and nickname for future use in allow-notify, @@ -15931,9 +15635,9 @@ zone "example.com" { This allows recursive queries of the server from the outside unless recursion has been previously disabled. - - - <command>Chroot</command> and <command>Setuid</command> +
    +
    <command>Chroot</command> and <command>Setuid</command> + On UNIX servers, it is possible to run BIND in a chrooted environment (using @@ -15957,8 +15661,7 @@ zone "example.com" { /usr/local/sbin/named -u 202 -t /var/named - - The <command>chroot</command> Environment +
    The <command>chroot</command> Environment In order for a chroot environment @@ -15984,10 +15687,9 @@ zone "example.com" { /dev/log, and /etc/localtime. - +
    - - Using the <command>setuid</command> Function +
    Using the <command>setuid</command> Function Prior to running the named daemon, @@ -16000,16 +15702,15 @@ zone "example.com" { to which you want BIND to write. - - Note that if the named daemon is running as an + + If the named daemon is running as an unprivileged user, it will not be able to bind to new restricted ports if the server is reloaded. - - - + +
    +
    - - Dynamic Update Security +
    Dynamic Update Security Access to the dynamic @@ -16051,15 +15752,14 @@ zone "example.com" { all. - +
    - - Troubleshooting - - Common Problems - - It's not working; how can I figure out what's wrong? + Troubleshooting + +
    Common Problems + +
    It's not working; how can I figure out what's wrong? The best solution to solving installation and @@ -16069,13 +15769,12 @@ zone "example.com" { what went wrong and how to fix the problem. - - - - Incrementing and Changing the Serial Number +
    +
    +
    Incrementing and Changing the Serial Number - Zone serial numbers are just numbers — they aren't + Zone serial numbers are just numbers — they aren't date related. A lot of people set them to a number that represents a date, usually of the form YYYYMMDDRR. Occasionally they will make a mistake and set them to a @@ -16100,9 +15799,8 @@ zone "example.com" { it to be, and reload the zone again. - - - Where Can I Get Help? +
    +
    Where Can I Get Help? The Internet Systems Consortium @@ -16120,125 +15818,120 @@ zone "example.com" { To discuss arrangements for support, contact - info@isc.org or visit the + info@isc.org or visit the ISC web page at - http://www.isc.org/services/support/ + http://www.isc.org/services/support/ to read more. - +
    - - Release Notes - + Release Notes + - - A Brief History of the <acronym>DNS</acronym> and <acronym>BIND</acronym> - - - Although the "official" beginning of the Domain Name - System occurred in 1984 with the publication of RFC 920, the - core of the new system was described in 1983 in RFCs 882 and - 883. From 1984 to 1987, the ARPAnet (the precursor to today's - Internet) became a testbed of experimentation for developing the - new naming/addressing scheme in a rapidly expanding, - operational network environment. New RFCs were written and - published in 1987 that modified the original documents to - incorporate improvements based on the working model. RFC 1034, - "Domain Names-Concepts and Facilities", and RFC 1035, "Domain - Names-Implementation and Specification" were published and - became the standards upon which all DNS implementations are - built. - + A Brief History of the <acronym>DNS</acronym> and <acronym>BIND</acronym> + + Although the "official" beginning of the Domain Name + System occurred in 1984 with the publication of RFC 920, the + core of the new system was described in 1983 in RFCs 882 and + 883. From 1984 to 1987, the ARPAnet (the precursor to today's + Internet) became a testbed of experimentation for developing the + new naming/addressing scheme in a rapidly expanding, + operational network environment. New RFCs were written and + published in 1987 that modified the original documents to + incorporate improvements based on the working model. RFC 1034, + "Domain Names-Concepts and Facilities", and RFC 1035, "Domain + Names-Implementation and Specification" were published and + became the standards upon which all DNS implementations are + built. + - - The first working domain name server, called "Jeeves", was - written in 1983-84 by Paul Mockapetris for operation on DEC - Tops-20 - machines located at the University of Southern California's - Information - Sciences Institute (USC-ISI) and SRI International's Network - Information - Center (SRI-NIC). A DNS server for - Unix machines, the Berkeley Internet - Name Domain (BIND) package, was - written soon after by a group of - graduate students at the University of California at Berkeley - under - a grant from the US Defense Advanced Research Projects - Administration - (DARPA). - - - Versions of BIND through - 4.8.3 were maintained by the Computer - Systems Research Group (CSRG) at UC Berkeley. Douglas Terry, Mark - Painter, David Riggle and Songnian Zhou made up the initial BIND - project team. After that, additional work on the software package - was done by Ralph Campbell. Kevin Dunlap, a Digital Equipment - Corporation - employee on loan to the CSRG, worked on BIND for 2 years, from 1985 - to 1987. Many other people also contributed to BIND development - during that time: Doug Kingston, Craig Partridge, Smoot - Carl-Mitchell, - Mike Muuss, Jim Bloom and Mike Schwartz. BIND maintenance was subsequently - handled by Mike Karels and Øivind Kure. - - - BIND versions 4.9 and 4.9.1 were - released by Digital Equipment - Corporation (now Compaq Computer Corporation). Paul Vixie, then - a DEC employee, became BIND's - primary caretaker. He was assisted - by Phil Almquist, Robert Elz, Alan Barrett, Paul Albitz, Bryan - Beecher, Andrew - Partan, Andy Cherenson, Tom Limoncelli, Berthold Paffrath, Fuat - Baran, Anant Kumar, Art Harkin, Win Treese, Don Lewis, Christophe - Wolfhugel, and others. - - - In 1994, BIND version 4.9.2 was sponsored by - Vixie Enterprises. Paul - Vixie became BIND's principal - architect/programmer. - - - BIND versions from 4.9.3 onward - have been developed and maintained - by the Internet Systems Consortium and its predecessor, - the Internet Software Consortium, with support being provided - by ISC's sponsors. - - - As co-architects/programmers, Bob Halley and - Paul Vixie released the first production-ready version of - BIND version 8 in May 1997. - - - BIND version 9 was released in September 2000 and is a - major rewrite of nearly all aspects of the underlying - BIND architecture. - - - BIND versions 4 and 8 are officially deprecated. - No additional development is done - on BIND version 4 or BIND version 8. - - - BIND development work is made - possible today by the sponsorship - of several corporations, and by the tireless work efforts of - numerous individuals. - - + + The first working domain name server, called "Jeeves", was + written in 1983-84 by Paul Mockapetris for operation on DEC + Tops-20 + machines located at the University of Southern California's + Information + Sciences Institute (USC-ISI) and SRI International's Network + Information + Center (SRI-NIC). A DNS server for + Unix machines, the Berkeley Internet + Name Domain (BIND) package, was + written soon after by a group of + graduate students at the University of California at Berkeley + under + a grant from the US Defense Advanced Research Projects + Administration + (DARPA). + + + Versions of BIND through + 4.8.3 were maintained by the Computer + Systems Research Group (CSRG) at UC Berkeley. Douglas Terry, Mark + Painter, David Riggle and Songnian Zhou made up the initial BIND + project team. After that, additional work on the software package + was done by Ralph Campbell. Kevin Dunlap, a Digital Equipment + Corporation + employee on loan to the CSRG, worked on BIND for 2 years, from 1985 + to 1987. Many other people also contributed to BIND development + during that time: Doug Kingston, Craig Partridge, Smoot + Carl-Mitchell, + Mike Muuss, Jim Bloom and Mike Schwartz. BIND maintenance was subsequently + handled by Mike Karels and Øivind Kure. + + + BIND versions 4.9 and 4.9.1 were + released by Digital Equipment + Corporation (now Compaq Computer Corporation). Paul Vixie, then + a DEC employee, became BIND's + primary caretaker. He was assisted + by Phil Almquist, Robert Elz, Alan Barrett, Paul Albitz, Bryan + Beecher, Andrew + Partan, Andy Cherenson, Tom Limoncelli, Berthold Paffrath, Fuat + Baran, Anant Kumar, Art Harkin, Win Treese, Don Lewis, Christophe + Wolfhugel, and others. + + + In 1994, BIND version 4.9.2 was sponsored by + Vixie Enterprises. Paul + Vixie became BIND's principal + architect/programmer. + + + BIND versions from 4.9.3 onward + have been developed and maintained + by the Internet Systems Consortium and its predecessor, + the Internet Software Consortium, with support being provided + by ISC's sponsors. + + + As co-architects/programmers, Bob Halley and + Paul Vixie released the first production-ready version of + BIND version 8 in May 1997. + + + BIND version 9 was released in September 2000 and is a + major rewrite of nearly all aspects of the underlying + BIND architecture. + + + BIND versions 4 and 8 are officially deprecated. + No additional development is done + on BIND version 4 or BIND version 8. + + + BIND development work is made + possible today by the sponsorship + of several corporations, and by the tireless work efforts of + numerous individuals. + - - General <acronym>DNS</acronym> Reference Information - - IPv6 addresses (AAAA) + General <acronym>DNS</acronym> Reference Information + +
    IPv6 addresses (AAAA) + IPv6 addresses are 128-bit identifiers for interfaces and sets of interfaces which were introduced in the DNS to facilitate @@ -16293,11 +15986,11 @@ zone "example.com" { string of zeros that can fit, and can be used only once in an address. - - - Bibliography (and Suggested Reading) - - Request for Comments (RFCs) +
    +
    Bibliography (and Suggested Reading) + +
    Request for Comments (RFCs) + Specification documents for the Internet protocol suite, including the DNS, are published as part of @@ -16307,886 +16000,537 @@ zone "example.com" { Engineering Steering Group (IESG). RFCs can be obtained online via FTP at: - + ftp://www.isi.edu/in-notes/RFCxxxx.txt - + (where xxxx is the number of the RFC). RFCs are also available via the Web at: - http://www.ietf.org/rfc/. + http://www.ietf.org/rfc/. - + Standards - Standards + RFC974 - - Partridge - C. - - Mail Routing and the Domain System + PartridgeC. + Mail Routing and the Domain System January 1986 RFC1034 - - Mockapetris - P.V. - - Domain Names — Concepts and Facilities + MockapetrisP.V. + Domain Names — Concepts and Facilities November 1987 RFC1035 - - Mockapetris - P. V. - Domain Names — Implementation and - Specification + MockapetrisP. V. Domain Names — Implementation and + Specification November 1987 - + Proposed Standards - Proposed Standards RFC2181 - - Elz - R., R. Bush - - Clarifications to the <acronym>DNS</acronym> - Specification + ElzR., R. Bush + Clarifications to the DNS + Specification July 1997 RFC2308 - - Andrews - M. - - Negative Caching of <acronym>DNS</acronym> - Queries + AndrewsM. + Negative Caching of DNS + Queries March 1998 RFC1995 - - Ohta - M. - - Incremental Zone Transfer in <acronym>DNS</acronym> + OhtaM. + Incremental Zone Transfer in DNS August 1996 RFC1996 - - Vixie - P. - - A Mechanism for Prompt Notification of Zone Changes + VixieP. + A Mechanism for Prompt Notification of Zone Changes August 1996 RFC2136 - - Vixie - P. - - - S. - Thomson - - - Y. - Rekhter - - - J. - Bound - + VixieP. + S.Thomson + Y.Rekhter + J.Bound - Dynamic Updates in the Domain Name System + Dynamic Updates in the Domain Name System April 1997 RFC2671 - - P. - Vixie - + P.Vixie - Extension Mechanisms for DNS (EDNS0) + Extension Mechanisms for DNS (EDNS0) August 1997 RFC2672 - - M. - Crawford - + M.Crawford - Non-Terminal DNS Name Redirection + Non-Terminal DNS Name Redirection August 1999 RFC2845 - - Vixie - P. - - - O. - Gudmundsson - - - D. - Eastlake - 3rd - - - B. - Wellington - + VixieP. + O.Gudmundsson + D.Eastlake3rd + B.Wellington - Secret Key Transaction Authentication for <acronym>DNS</acronym> (TSIG) + Secret Key Transaction Authentication for DNS (TSIG) May 2000 RFC2930 - - D. - Eastlake - 3rd - + D.Eastlake3rd - Secret Key Establishment for DNS (TKEY RR) + Secret Key Establishment for DNS (TKEY RR) September 2000 RFC2931 - - D. - Eastlake - 3rd - + D.Eastlake3rd - DNS Request and Transaction Signatures (SIG(0)s) + DNS Request and Transaction Signatures (SIG(0)s) September 2000 RFC3007 - - B. - Wellington - + B.Wellington - Secure Domain Name System (DNS) Dynamic Update + Secure Domain Name System (DNS) Dynamic Update November 2000 RFC3645 - - S. - Kwan - - - P. - Garg - - - J. - Gilroy - - - L. - Esibov - - - J. - Westhead - - - R. - Hall - + S.Kwan + P.Garg + J.Gilroy + L.Esibov + J.Westhead + R.Hall - Generic Security Service Algorithm for Secret + <citetitle>Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS - (GSS-TSIG) + (GSS-TSIG) October 2003 - - <acronym>DNS</acronym> Security Proposed Standards + <acronym>DNS</acronym> Security Proposed Standards + RFC3225 - - D. - Conrad - + D.Conrad - Indicating Resolver Support of DNSSEC + Indicating Resolver Support of DNSSEC December 2001 RFC3833 - - D. - Atkins - - - R. - Austein - + D.Atkins + R.Austein - Threat Analysis of the Domain Name System (DNS) + Threat Analysis of the Domain Name System (DNS) August 2004 RFC4033 - - R. - Arends - - - R. - Austein - - - M. - Larson - - - D. - Massey - - - S. - Rose - + R.Arends + R.Austein + M.Larson + D.Massey + S.Rose - DNS Security Introduction and Requirements + DNS Security Introduction and Requirements March 2005 RFC4034 - - R. - Arends - - - R. - Austein - - - M. - Larson - - - D. - Massey - - - S. - Rose - + R.Arends + R.Austein + M.Larson + D.Massey + S.Rose - Resource Records for the DNS Security Extensions + Resource Records for the DNS Security Extensions March 2005 RFC4035 - - R. - Arends - - - R. - Austein - - - M. - Larson - - - D. - Massey - - - S. - Rose - + R.Arends + R.Austein + M.Larson + D.Massey + S.Rose - Protocol Modifications for the DNS - Security Extensions + Protocol Modifications for the DNS + Security Extensions March 2005 - - Other Important RFCs About <acronym>DNS</acronym> - Implementation + Other Important RFCs About <acronym>DNS</acronym> + Implementation + RFC1535 - - Gavron - E. - - A Security Problem and Proposed Correction With Widely - Deployed <acronym>DNS</acronym> Software. + GavronE. + A Security Problem and Proposed Correction With Widely + Deployed DNS Software. October 1993 RFC1536 - - Kumar - A. - - - J. - Postel - - - C. - Neuman - - - P. - Danzig - - - S. - Miller - + KumarA. + J.Postel + C.Neuman + P.Danzig + S.Miller - Common <acronym>DNS</acronym> Implementation - Errors and Suggested Fixes + Common DNS Implementation + Errors and Suggested Fixes October 1993 RFC1982 - - Elz - R. - - - R. - Bush - + ElzR. + R.Bush - Serial Number Arithmetic + Serial Number Arithmetic August 1996 RFC4074 - - Morishita - Y. - - - T. - Jinmei - + MorishitaY. + T.Jinmei - Common Misbehaviour Against <acronym>DNS</acronym> - Queries for IPv6 Addresses + Common Misbehaviour Against DNS + Queries for IPv6 Addresses May 2005 - - Resource Record Types + Resource Record Types + RFC1183 - - Everhart - C.F. - - - L. A. - Mamakos - - - R. - Ullmann - - - P. - Mockapetris - + EverhartC.F. + L. A.Mamakos + R.Ullmann + P.Mockapetris - New <acronym>DNS</acronym> RR Definitions + New DNS RR Definitions October 1990 RFC1706 - - Manning - B. - - - R. - Colella - + ManningB. + R.Colella - <acronym>DNS</acronym> NSAP Resource Records + DNS NSAP Resource Records October 1994 RFC2168 - - Daniel - R. - - - M. - Mealling - + DanielR. + M.Mealling - Resolution of Uniform Resource Identifiers using - the Domain Name System + Resolution of Uniform Resource Identifiers using + the Domain Name System June 1997 RFC1876 - - Davis - C. - - - P. - Vixie - - - T. - Goodwin - - - I. - Dickinson - + DavisC. + P.Vixie + T.Goodwin + I.Dickinson - A Means for Expressing Location Information in the + <citetitle>A Means for Expressing Location Information in the Domain - Name System + Name System January 1996 RFC2052 - - Gulbrandsen - A. - - - P. - Vixie - + GulbrandsenA. + P.Vixie - A <acronym>DNS</acronym> RR for Specifying the + <citetitle>A <acronym>DNS</acronym> RR for Specifying the Location of - Services. + Services. October 1996 RFC2163 - - Allocchio - A. - - Using the Internet <acronym>DNS</acronym> to + <author><personname><surname>Allocchio</surname><firstname>A.</firstname></personname></author> + <citetitle>Using the Internet <acronym>DNS</acronym> to Distribute MIXER - Conformant Global Address Mapping + Conformant Global Address Mapping January 1998 RFC2230 - - Atkinson - R. - - Key Exchange Delegation Record for the <acronym>DNS</acronym> + AtkinsonR. + Key Exchange Delegation Record for the DNS October 1997 RFC2536 - - Eastlake - D. - 3rd - - DSA KEYs and SIGs in the Domain Name System (DNS) + EastlakeD.3rd + DSA KEYs and SIGs in the Domain Name System (DNS) March 1999 RFC2537 - - Eastlake - D. - 3rd - - RSA/MD5 KEYs and SIGs in the Domain Name System (DNS) + EastlakeD.3rd + RSA/MD5 KEYs and SIGs in the Domain Name System (DNS) March 1999 RFC2538 - - Eastlake - D. - 3rd - - - Gudmundsson - O. - + EastlakeD.3rd + GudmundssonO. - Storing Certificates in the Domain Name System (DNS) + Storing Certificates in the Domain Name System (DNS) March 1999 RFC2539 - - Eastlake - D. - 3rd - + EastlakeD.3rd - Storage of Diffie-Hellman Keys in the Domain Name System (DNS) + Storage of Diffie-Hellman Keys in the Domain Name System (DNS) March 1999 RFC2540 - - Eastlake - D. - 3rd - + EastlakeD.3rd - Detached Domain Name System (DNS) Information + Detached Domain Name System (DNS) Information March 1999 RFC2782 - - Gulbrandsen - A. - - - Vixie - P. - - - Esibov - L. - - A DNS RR for specifying the location of services (DNS SRV) + GulbrandsenA. + VixieP. + EsibovL. + A DNS RR for specifying the location of services (DNS SRV) February 2000 RFC2915 - - Mealling - M. - - - Daniel - R. - - The Naming Authority Pointer (NAPTR) DNS Resource Record + MeallingM. + DanielR. + The Naming Authority Pointer (NAPTR) DNS Resource Record September 2000 RFC3110 - - Eastlake - D. - 3rd - - RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS) + EastlakeD.3rd + RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS) May 2001 RFC3123 - - Koch - P. - - A DNS RR Type for Lists of Address Prefixes (APL RR) + KochP. + A DNS RR Type for Lists of Address Prefixes (APL RR) June 2001 RFC3596 - - Thomson - S. - - - C. - Huitema - - - V. - Ksinant - - - M. - Souissi - + ThomsonS. + C.Huitema + V.Ksinant + M.Souissi - <acronym>DNS</acronym> Extensions to support IP - version 6 + DNS Extensions to support IP + version 6 October 2003 RFC3597 - - Gustafsson - A. - - Handling of Unknown DNS Resource Record (RR) Types + GustafssonA. + Handling of Unknown DNS Resource Record (RR) Types September 2003 - - <acronym>DNS</acronym> and the Internet + <acronym>DNS</acronym> and the Internet + RFC1101 - - Mockapetris - P. V. - - <acronym>DNS</acronym> Encoding of Network Names - and Other Types + MockapetrisP. V. + DNS Encoding of Network Names + and Other Types April 1989 RFC1123 - - Braden - R. - - Requirements for Internet Hosts - Application and - Support + BradenR. + Requirements for Internet Hosts - Application and + Support October 1989 RFC1591 - - Postel - J. - - Domain Name System Structure and Delegation + PostelJ. + Domain Name System Structure and Delegation March 1994 RFC2317 - - Eidnes - H. - - - G. - de Groot - - - P. - Vixie - + EidnesH. + G.de Groot + P.Vixie - Classless IN-ADDR.ARPA Delegation + Classless IN-ADDR.ARPA Delegation March 1998 RFC2826 - - Internet Architecture Board - + Internet Architecture Board - IAB Technical Comment on the Unique DNS Root + IAB Technical Comment on the Unique DNS Root May 2000 RFC2929 - - Eastlake - D. - 3rd - - - Brunner-Williams - E. - - - Manning - B. - + EastlakeD.3rd + Brunner-WilliamsE. + ManningB. - Domain Name System (DNS) IANA Considerations + Domain Name System (DNS) IANA Considerations September 2000 - - <acronym>DNS</acronym> Operations + <acronym>DNS</acronym> Operations + RFC1033 - - Lottor - M. - - Domain administrators operations guide. + LottorM. + Domain administrators operations guide. November 1987 RFC1537 - - Beertema - P. - - Common <acronym>DNS</acronym> Data File - Configuration Errors + BeertemaP. + Common DNS Data File + Configuration Errors October 1993 RFC1912 - - Barr - D. - - Common <acronym>DNS</acronym> Operational and - Configuration Errors + BarrD. + Common DNS Operational and + Configuration Errors February 1996 RFC2010 - - Manning - B. - - - P. - Vixie - + ManningB. + P.Vixie - Operational Criteria for Root Name Servers. + Operational Criteria for Root Name Servers. October 1996 RFC2219 - - Hamilton - M. - - - R. - Wright - + HamiltonM. + R.Wright - Use of <acronym>DNS</acronym> Aliases for - Network Services. + Use of DNS Aliases for + Network Services. October 1997 - - Internationalized Domain Names + Internationalized Domain Names + RFC2825 - - IAB - - - Daigle - R. - + IAB + DaigleR. - A Tangled Web: Issues of I18N, Domain Names, - and the Other Internet protocols + A Tangled Web: Issues of I18N, Domain Names, + and the Other Internet protocols May 2000 RFC3490 - - Faltstrom - P. - - - Hoffman - P. - - - Costello - A. - + FaltstromP. + HoffmanP. + CostelloA. - Internationalizing Domain Names in Applications (IDNA) + Internationalizing Domain Names in Applications (IDNA) March 2003 RFC3491 - - Hoffman - P. - - - Blanchet - M. - + HoffmanP. + BlanchetM. - Nameprep: A Stringprep Profile for Internationalized Domain Names + Nameprep: A Stringprep Profile for Internationalized Domain Names March 2003 RFC3492 - - Costello - A. - + CostelloA. - Punycode: A Bootstring encoding of Unicode + <citetitle>Punycode: A Bootstring encoding of Unicode for Internationalized Domain Names in - Applications (IDNA) + Applications (IDNA) March 2003 - - Other <acronym>DNS</acronym>-related RFCs + Other <acronym>DNS</acronym>-related RFCs + Note: the following list of RFCs, although @@ -17196,165 +16540,108 @@ zone "example.com" { RFC1464 - - Rosenbaum - R. - - Using the Domain Name System To Store Arbitrary String - Attributes + RosenbaumR. + Using the Domain Name System To Store Arbitrary String + Attributes May 1993 RFC1713 - - Romao - A. - - Tools for <acronym>DNS</acronym> Debugging + RomaoA. + Tools for DNS Debugging November 1994 RFC1794 - - Brisco - T. - - <acronym>DNS</acronym> Support for Load - Balancing + BriscoT. + DNS Support for Load + Balancing April 1995 RFC2240 - - Vaughan - O. - - A Legal Basis for Domain Name Allocation + VaughanO. + A Legal Basis for Domain Name Allocation November 1997 RFC2345 - - Klensin - J. - - - T. - Wolf - - - G. - Oglesby - + KlensinJ. + T.Wolf + G.Oglesby - Domain Names and Company Name Retrieval + Domain Names and Company Name Retrieval May 1998 RFC2352 - - Vaughan - O. - - A Convention For Using Legal Names as Domain Names + VaughanO. + A Convention For Using Legal Names as Domain Names May 1998 RFC3071 - - Klensin - J. - + KlensinJ. - Reflections on the DNS, RFC 1591, and Categories of Domains + Reflections on the DNS, RFC 1591, and Categories of Domains February 2001 RFC3258 - - Hardie - T. - + HardieT. - Distributing Authoritative Name Servers via - Shared Unicast Addresses + Distributing Authoritative Name Servers via + Shared Unicast Addresses April 2002 RFC3901 - - Durand - A. - - - J. - Ihren - + DurandA. + J.Ihren - DNS IPv6 Transport Operational Guidelines + DNS IPv6 Transport Operational Guidelines September 2004 - - Obsolete and Unimplemented Experimental RFC + Obsolete and Unimplemented Experimental RFC + RFC1712 - - Farrell - C. - - - M. - Schulze - - - S. - Pleitner - - - D. - Baldoni - + FarrellC. + M.Schulze + S.Pleitner + D.Baldoni - <acronym>DNS</acronym> Encoding of Geographical - Location + DNS Encoding of Geographical + Location November 1994 RFC2673 - - Crawford - M. - + CrawfordM. - Binary Labels in the Domain Name System + Binary Labels in the Domain Name System August 1999 RFC2874 - - Crawford - M. - - - Huitema - C. - + CrawfordM. + HuitemaC. - DNS Extensions to Support IPv6 Address Aggregation - and Renumbering + DNS Extensions to Support IPv6 Address Aggregation + and Renumbering July 2000 - - Obsoleted DNS Security RFCs + Obsoleted DNS Security RFCs + Most of these have been consolidated into RFC4033, @@ -17364,152 +16651,101 @@ zone "example.com" { RFC2065 - - Eastlake - 3rd - D. - - - C. - Kaufman - + Eastlake3rdD. + C.Kaufman - Domain Name System Security Extensions + Domain Name System Security Extensions January 1997 RFC2137 - - Eastlake - 3rd - D. - - Secure Domain Name System Dynamic Update + Eastlake3rdD. + Secure Domain Name System Dynamic Update April 1997 RFC2535 - - Eastlake - 3rd - D. - + Eastlake3rdD. - Domain Name System Security Extensions + Domain Name System Security Extensions March 1999 RFC3008 - - Wellington - B. - + WellingtonB. - Domain Name System Security (DNSSEC) - Signing Authority + Domain Name System Security (DNSSEC) + Signing Authority November 2000 RFC3090 - - Lewis - E. - + LewisE. - DNS Security Extension Clarification on Zone Status + DNS Security Extension Clarification on Zone Status March 2001 RFC3445 - - Massey - D. - - - Rose - S. - + MasseyD. + RoseS. - Limiting the Scope of the KEY Resource Record (RR) + Limiting the Scope of the KEY Resource Record (RR) December 2002 RFC3655 - - Wellington - B. - - - Gudmundsson - O. - + WellingtonB. + GudmundssonO. - Redefinition of DNS Authenticated Data (AD) bit + Redefinition of DNS Authenticated Data (AD) bit November 2003 RFC3658 - - Gudmundsson - O. - + GudmundssonO. - Delegation Signer (DS) Resource Record (RR) + Delegation Signer (DS) Resource Record (RR) December 2003 RFC3755 - - Weiler - S. - + WeilerS. - Legacy Resolver Compatibility for Delegation Signer (DS) + Legacy Resolver Compatibility for Delegation Signer (DS) May 2004 RFC3757 - - Kolkman - O. - - - Schlyter - J. - - - Lewis - E. - + KolkmanO. + SchlyterJ. + LewisE. - Domain Name System KEY (DNSKEY) Resource Record - (RR) Secure Entry Point (SEP) Flag + Domain Name System KEY (DNSKEY) Resource Record + (RR) Secure Entry Point (SEP) Flag April 2004 RFC3845 - - Schlyter - J. - + SchlyterJ. - DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format + DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format August 2004 - - - Internet Drafts +
    +
    Internet Drafts + Internet Drafts (IDs) are rough-draft working documents of the Internet Engineering Task Force. They are, in essence, RFCs @@ -17520,71 +16756,59 @@ zone "example.com" { they are "works in progress." IDs have a lifespan of six months after which they are deleted unless updated by their authors. - - - Other Documents About <acronym>BIND</acronym> +
    +
    Other Documents About <acronym>BIND</acronym> + - - Albitz - Paul - - - Cricket - Liu - + AlbitzPaul + CricketLiu - <acronym>DNS</acronym> and <acronym>BIND</acronym> + DNS and BIND 1998 Sebastopol, CA: O'Reilly and Associates - - +
    +
    - - BIND 9 DNS Library Support - + BIND 9 DNS Library Support + - - Manual pages - - - - - - - - - - - - - - - - - - - - - - - - - + Manual pages + + + + + + + + + + + + + + + + + + + + + + + + + + +     - - diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch01.html b/contrib/bind9/doc/arm/Bv9ARM.ch01.html index 2d25f2702..ea1407325 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch01.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch01.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Chapter 1. Introduction - - + + @@ -39,23 +38,23 @@
    -
    -

    -Chapter 1. Introduction

    +
    +

    +Chapter 1. Introduction

    Table of Contents

    -
    -
    Scope of Document
    -
    Organization of This Document
    -
    Conventions Used in This Document
    -
    The Domain Name System (DNS)
    +
    +
    Scope of Document
    +
    Organization of This Document
    +
    Conventions Used in This Document
    +
    The Domain Name System (DNS)
    -
    DNS Fundamentals
    -
    Domains and Domain Names
    -
    Zones
    -
    Authoritative Name Servers
    -
    Caching Name Servers
    -
    Name Servers in Multiple Roles
    +
    DNS Fundamentals
    +
    Domains and Domain Names
    +
    Zones
    +
    Authoritative Name Servers
    +
    Caching Name Servers
    +
    Name Servers in Multiple Roles
    @@ -69,9 +68,9 @@ group of distributed hierarchical databases.

    -
    +

    -Scope of Document

    +Scope of Document

    The Berkeley Internet Name Domain (BIND) implements a @@ -83,9 +82,9 @@

    This version of the manual corresponds to BIND version 9.9.

    -
    +

    -Organization of This Document

    +Organization of This Document

    In this document, Chapter 1 introduces the basic DNS and BIND concepts. Chapter 2 @@ -112,17 +111,17 @@ System.

    -
    +

    -Conventions Used in This Document

    +Conventions Used in This Document

    In this document, we use the following general typographic conventions:

    --++ @@ -182,8 +181,8 @@ BIND configuration file:

    --++ @@ -239,9 +238,9 @@

    -
    +

    -The Domain Name System (DNS)

    +The Domain Name System (DNS)

    The purpose of this document is to explain the installation and upkeep of the BIND (Berkeley Internet @@ -249,9 +248,9 @@ begin by reviewing the fundamentals of the Domain Name System (DNS) as they relate to BIND.

    -
    +

    -DNS Fundamentals

    +DNS Fundamentals

    The Domain Name System (DNS) is a hierarchical, distributed database. It stores information for mapping Internet host names to @@ -265,15 +264,15 @@ more name servers and interprets the responses. The BIND 9 software distribution contains a - name server, named, and a resolver - library, liblwres. The older - libbind resolver library is also available + name server, named, and a resolver + library, liblwres. The older + libbind resolver library is also available from ISC as a separate download.

    -
    +

    -Domains and Domain Names

    +Domains and Domain Names

    The data stored in the DNS is identified by domain names that are organized as a tree according to organizational or administrative boundaries. Each node of the tree, @@ -309,17 +308,17 @@ The data associated with each domain name is stored in the form of resource records (RRs). Some of the supported resource record types are described in - the section called “Types of Resource Records and When to Use Them”. + the section called “Types of Resource Records and When to Use Them”.

    For more detailed information about the design of the DNS and the DNS protocol, please refer to the standards documents listed in - the section called “Request for Comments (RFCs)”. + the section called “Request for Comments (RFCs)”.

    -
    +

    -Zones

    +Zones

    To properly operate a name server, it is important to understand the difference between a zone @@ -370,9 +369,9 @@ actually asking for slave service for some collection of zones.

    -
    +

    -Authoritative Name Servers

    +Authoritative Name Servers

    Each zone is served by at least one authoritative name server, @@ -385,11 +384,11 @@ Responses from authoritative servers have the "authoritative answer" (AA) bit set in the response packets. This makes them easy to identify when debugging DNS configurations using tools like - dig (the section called “Diagnostic Tools”). + dig (the section called “Diagnostic Tools”).

    -
    +

    -The Primary Master

    +The Primary Master

    The authoritative server where the master copy of the zone data is maintained is called the @@ -407,9 +406,9 @@ dynamic update operations.

    -
    +

    -Slave Servers

    +Slave Servers

    The other authoritative servers, the slave servers (also known as secondary servers) @@ -423,9 +422,9 @@ may itself act as a master to a subordinate slave server.

    -
    +

    -Stealth Servers

    +Stealth Servers

    Usually all of the zone's authoritative servers are listed in NS records in the parent zone. These NS records constitute @@ -458,9 +457,9 @@

    -
    +

    -Caching Name Servers

    +Caching Name Servers

    The resolver libraries provided by most operating systems are stub resolvers, meaning that they are not @@ -485,9 +484,9 @@ the cache of a caching name server is controlled by the Time To Live (TTL) field associated with each resource record.

    -
    +

    -Forwarding

    +Forwarding

    Even a caching name server does not necessarily perform the complete recursive lookup itself. Instead, it can @@ -512,9 +511,9 @@

    -
    +

    -Name Servers in Multiple Roles

    +Name Servers in Multiple Roles

    The BIND name server can simultaneously act as @@ -556,6 +555,6 @@

    -

    BIND 9.9.8-P4 (Extended Support Version)

    +

    BIND 9.9.9-P3 (Extended Support Version)

    diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch02.html b/contrib/bind9/doc/arm/Bv9ARM.ch02.html index 3500ab4d6..8f65b88b8 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch02.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch02.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Chapter 2. BIND Resource Requirements - - + + @@ -39,22 +38,22 @@
    -
    -

    -Chapter 2. BIND Resource Requirements

    +
    +

    +Chapter 2. BIND Resource Requirements

    Table of Contents

    -
    -
    Hardware requirements
    -
    CPU Requirements
    -
    Memory Requirements
    -
    Name Server Intensive Environment Issues
    -
    Supported Operating Systems
    +
    +
    Hardware requirements
    +
    CPU Requirements
    +
    Memory Requirements
    +
    Name Server Intensive Environment Issues
    +
    Supported Operating Systems
    -
    +

    -Hardware requirements

    +Hardware requirements

    DNS hardware requirements have traditionally been quite modest. @@ -71,9 +70,9 @@ multiprocessor systems for installations that need it.

    -
    +

    -CPU Requirements

    +CPU Requirements

    CPU requirements for BIND 9 range from i486-class machines @@ -82,18 +81,18 @@ signed zones, serving many thousands of queries per second.

    -
    +

    -Memory Requirements

    +Memory Requirements

    The memory of the server has to be large enough to fit the - cache and zones loaded off disk. The max-cache-size + cache and zones loaded off disk. The max-cache-size option can be used to limit the amount of memory used by the cache, at the expense of reducing cache hit rates and causing more DNS traffic. Additionally, if additional section caching - (the section called “Additional Section Caching”) is enabled, - the max-acache-size option can be used to + (the section called “Additional Section Caching”) is enabled, + the max-acache-size option can be used to limit the amount of memory used by the mechanism. It is still good practice to have enough memory to load @@ -105,9 +104,9 @@ fast as they are being inserted.

    -
    +

    -Name Server Intensive Environment Issues

    +Name Server Intensive Environment Issues

    For name server intensive environments, there are two alternative configurations that may be used. The first is where clients and @@ -122,9 +121,9 @@ as none of the name servers share their cached data.

    -
    +

    -Supported Operating Systems

    +Supported Operating Systems

    ISC BIND 9 compiles and runs on a large number @@ -154,6 +153,6 @@

    -

    BIND 9.9.8-P4 (Extended Support Version)

    +

    BIND 9.9.9-P3 (Extended Support Version)

    diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch03.html b/contrib/bind9/doc/arm/Bv9ARM.ch03.html index 0131e3011..fa8094762 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch03.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch03.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Chapter 3. Name Server Configuration - - + + @@ -39,22 +38,22 @@
    -
    -

    -Chapter 3. Name Server Configuration

    +
    +

    +Chapter 3. Name Server Configuration

    Table of Contents

    -
    -
    Sample Configurations
    +
    +
    Sample Configurations
    -
    A Caching-only Name Server
    -
    An Authoritative-only Name Server
    +
    A Caching-only Name Server
    +
    An Authoritative-only Name Server
    -
    Load Balancing
    -
    Name Server Operations
    +
    Load Balancing
    +
    Name Server Operations
    -
    Tools for Use With the Name Server Daemon
    -
    Signals
    +
    Tools for Use With the Name Server Daemon
    +
    Signals
    @@ -63,17 +62,17 @@ with guidelines for their use. We suggest reasonable values for certain option settings.

    -
    +

    Sample Configurations

    -
    +

    -A Caching-only Name Server

    +A Caching-only Name Server

    The following sample configuration is appropriate for a caching-only name server for use by clients internal to a corporation. All queries - from outside clients are refused using the allow-query + from outside clients are refused using the allow-query option. Alternatively, the same effect could be achieved using suitable firewall rules. @@ -96,9 +95,9 @@ zone "0.0.127.in-addr.arpa" { };

    -
    +

    -An Authoritative-only Name Server

    +An Authoritative-only Name Server

    This sample configuration is for an authoritative-only server that is the master server for "example.com" @@ -144,9 +143,9 @@ zone "eng.example.com" {

    -
    +

    -Load Balancing

    +Load Balancing

    A primitive form of load balancing can be achieved in the DNS by using multiple records @@ -160,11 +159,11 @@ zone "eng.example.com" {

    -----+++++ @@ -282,38 +281,38 @@ zone "eng.example.com" {

    For more detail on ordering responses, check the - rrset-order sub-statement in the - options statement, see - RRset Ordering. + rrset-order sub-statement in the + options statement, see + RRset Ordering.

    -
    +

    -Name Server Operations

    -
    +Name Server Operations
    +

    -Tools for Use With the Name Server Daemon

    +Tools for Use With the Name Server Daemon

    This section describes several indispensable diagnostic, administrative and monitoring tools available to the system administrator for controlling and debugging the name server daemon.

    -
    +

    Diagnostic Tools

    - The dig, host, and - nslookup programs are all command + The dig, host, and + nslookup programs are all command line tools for manually querying name servers. They differ in style and output format.

    -
    -
    dig
    +
    +
    dig

    - The domain information groper (dig) + The domain information groper (dig) is the most versatile and complete of these lookup tools. It has two modes: simple interactive mode for a single query, and batch mode which executes a @@ -324,21 +323,21 @@ zone "eng.example.com" {

    dig [@server] domain [query-type] [query-class] [+query-option] [-dig-option] [%comment]

    - The usual simple use of dig will take the form + The usual simple use of dig will take the form

    -

    - dig @server domain query-type query-class +

    + dig @server domain query-type query-class

    For more information and a list of available commands and - options, see the dig man + options, see the dig man page.

    -
    host
    +
    host

    - The host utility emphasizes + The host utility emphasizes simplicity and ease of use. By default, it converts between host names and Internet addresses, but its @@ -348,13 +347,13 @@ zone "eng.example.com" {

    host [-aCdlnrsTwv] [-c class] [-N ndots] [-t type] [-W timeout] [-R retries] [-m flag] [-4] [-6] hostname [server]

    For more information and a list of available commands and - options, see the host man + options, see the host man page.

    -
    nslookup
    +
    nslookup
    -

    nslookup +

    nslookup has two modes: interactive and non-interactive. Interactive mode allows the user to query name servers for information about various @@ -382,144 +381,143 @@ zone "eng.example.com" {

    Due to its arcane user interface and frequently inconsistent - behavior, we do not recommend the use of nslookup. - Use dig instead. + behavior, we do not recommend the use of nslookup. + Use dig instead.

    -
    +

    Administrative Tools

    Administrative tools play an integral part in the management of a server.

    -
    +
    -named-checkconf +named-checkconf

    - The named-checkconf program + The named-checkconf program checks the syntax of a named.conf file.

    named-checkconf [-jvz] [-t directory] [filename]

    -named-checkzone +named-checkzone

    - The named-checkzone program + The named-checkzone program checks a master file for syntax and consistency.

    named-checkzone [-djqvD] [-c class] [-o output] [-t directory] [-w directory] [-k (ignore|warn|fail)] [-n (ignore|warn|fail)] [-W (ignore|warn)] zone [filename]

    -named-compilezone +named-compilezone

    - Similar to named-checkzone, but + Similar to named-checkzone, but it always dumps the zone content to a specified file (typically in a different format).

    -rndc +rndc

    The remote name daemon control - (rndc) program allows the + (rndc) program allows the system administrator to control the operation of a name server. - Since BIND 9.2, rndc - supports all the commands of the BIND 8 ndc - utility except ndc start and - ndc restart, which were also - not supported in ndc's + Since BIND 9.2, rndc + supports all the commands of the BIND 8 ndc + utility except ndc start and + ndc restart, which were also + not supported in ndc's channel mode. - If you run rndc without any + If you run rndc without any options it will display a usage message as follows:

    rndc [-c config] [-s server] [-p port] [-y key] command [command...]

    -

    See rndc(8) for details of - the available rndc commands. +

    See rndc(8) for details of + the available rndc commands.

    - rndc requires a configuration file, + rndc requires a configuration file, since all communication with the server is authenticated with digital signatures that rely on a shared secret, and there is no way to provide that secret other than with a configuration file. The default location for the - rndc configuration file is + rndc configuration file is /etc/rndc.conf, but an alternate location can be specified with the -c option. If the configuration file is not found, - rndc will also look in + rndc will also look in /etc/rndc.key (or whatever sysconfdir was defined when the BIND build was configured). The rndc.key file is generated by - running rndc-confgen -a as + running rndc-confgen -a as described in - the section called “controls Statement Definition and + the section called “controls Statement Definition and Usage”.

    The format of the configuration file is similar to that of named.conf, but limited to - only four statements, the options, - key, server and - include + only four statements, the options, + key, server and + include statements. These statements are what associate the secret keys to the servers with which they are meant to be shared. The order of statements is not significant.

    - The options statement has + The options statement has three clauses: - default-server, default-key, - and default-port. - default-server takes a + default-server, default-key, + and default-port. + default-server takes a host name or address argument and represents the server that will be contacted if no -s option is provided on the command line. - default-key takes - the name of a key as its argument, as defined by a key statement. - default-port specifies the + default-key takes + the name of a key as its argument, as defined by a key statement. + default-port specifies the port to which - rndc should connect if no + rndc should connect if no port is given on the command line or in a - server statement. + server statement.

    - The key statement defines a + The key statement defines a key to be used - by rndc when authenticating + by rndc when authenticating with - named. Its syntax is + named. Its syntax is identical to the - key statement in named.conf. + key statement in named.conf. The keyword key is followed by a key name, which must be a valid domain name, though it need not actually be hierarchical; thus, a string like "rndc_key" is a valid name. - The key statement has two + The key statement has two clauses: - algorithm and secret. + algorithm and secret. While the configuration parser will accept any string as the argument to algorithm, currently only the string "hmac-md5" @@ -527,18 +525,18 @@ zone "eng.example.com" { as specified in RFC 3548.

    - The server statement + The server statement associates a key - defined using the key + defined using the key statement with a server. The keyword server is followed by a - host name or address. The server statement - has two clauses: key and port. - The key clause specifies the + host name or address. The server statement + has two clauses: key and port. + The key clause specifies the name of the key to be used when communicating with this server, and the - port clause can be used to - specify the port rndc should + port clause can be used to + specify the port rndc should connect to on the server.

    @@ -580,15 +578,15 @@ controls { rndc_key.

    - Running the rndc-confgen + Running the rndc-confgen program will conveniently create a rndc.conf file for you, and also display the - corresponding controls + corresponding controls statement that you need to add to named.conf. Alternatively, - you can run rndc-confgen -a + you can run rndc-confgen -a to set up a rndc.key file and not modify @@ -598,23 +596,23 @@ controls {

    -
    +

    -Signals

    +Signals

    Certain UNIX signals cause the name server to take specific actions, as described in the following table. These signals can - be sent using the kill command. + be sent using the kill command.

    --++
    -

    SIGHUP

    +

    SIGHUP

    @@ -625,7 +623,7 @@ controls {

    -

    SIGTERM

    +

    SIGTERM

    @@ -635,7 +633,7 @@ controls {

    -

    SIGINT

    +

    SIGINT

    @@ -665,6 +663,6 @@ controls {

    -

    BIND 9.9.8-P4 (Extended Support Version)

    +

    BIND 9.9.9-P3 (Extended Support Version)

    diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch04.html b/contrib/bind9/doc/arm/Bv9ARM.ch04.html index 429f7b59f..fc56caf65 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch04.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch04.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Chapter 4. Advanced DNS Features - - + + @@ -39,100 +38,101 @@
    -
    -

    -Chapter 4. Advanced DNS Features

    +
    +

    +Chapter 4. Advanced DNS Features

    Table of Contents

    -
    -
    Notify
    -
    Dynamic Update
    -
    The journal file
    -
    Incremental Zone Transfers (IXFR)
    -
    Split DNS
    -
    Example split DNS setup
    -
    TSIG
    +
    +
    Notify
    +
    Dynamic Update
    +
    The journal file
    +
    Incremental Zone Transfers (IXFR)
    +
    Split DNS
    +
    Example split DNS setup
    +
    TSIG
    -
    Generate Shared Keys for Each Pair of Hosts
    -
    Copying the Shared Secret to Both Machines
    -
    Informing the Servers of the Key's Existence
    -
    Instructing the Server to Use the Key
    -
    TSIG Key Based Access Control
    -
    Errors
    +
    Generating a Shared Key
    +
    Loading A New Key
    +
    Instructing the Server to Use a Key
    +
    TSIG-Based Access Control
    +
    Errors
    -
    TKEY
    -
    SIG(0)
    -
    DNSSEC
    +
    TKEY
    +
    SIG(0)
    +
    DNSSEC
    -
    Generating Keys
    -
    Signing the Zone
    -
    Configuring Servers
    +
    Generating Keys
    +
    Signing the Zone
    +
    Configuring Servers
    -
    DNSSEC, Dynamic Zones, and Automatic Signing
    +
    DNSSEC, Dynamic Zones, and Automatic Signing
    -
    Converting from insecure to secure
    -
    Dynamic DNS update method
    -
    Fully automatic zone signing
    -
    Private-type records
    -
    DNSKEY rollovers
    -
    Dynamic DNS update method
    -
    Automatic key rollovers
    -
    NSEC3PARAM rollovers via UPDATE
    -
    Converting from NSEC to NSEC3
    -
    Converting from NSEC3 to NSEC
    -
    Converting from secure to insecure
    -
    Periodic re-signing
    -
    NSEC3 and OPTOUT
    +
    Converting from insecure to secure
    +
    Dynamic DNS update method
    +
    Fully automatic zone signing
    +
    Private-type records
    +
    DNSKEY rollovers
    +
    Dynamic DNS update method
    +
    Automatic key rollovers
    +
    NSEC3PARAM rollovers via UPDATE
    +
    Converting from NSEC to NSEC3
    +
    Converting from NSEC3 to NSEC
    +
    Converting from secure to insecure
    +
    Periodic re-signing
    +
    NSEC3 and OPTOUT
    -
    Dynamic Trust Anchor Management
    +
    Dynamic Trust Anchor Management
    -
    Validating Resolver
    -
    Authoritative Server
    +
    Validating Resolver
    +
    Authoritative Server
    -
    PKCS #11 (Cryptoki) support
    +
    PKCS #11 (Cryptoki) support
    -
    Prerequisites
    -
    Building BIND 9 with PKCS#11
    -
    PKCS #11 Tools
    -
    Using the HSM
    -
    Specifying the engine on the command line
    -
    Running named with automatic zone re-signing
    +
    Prerequisites
    +
    Building BIND 9 with PKCS#11
    +
    PKCS #11 Tools
    +
    Using the HSM
    +
    Specifying the engine on the command line
    +
    Running named with automatic zone re-signing
    -
    IPv6 Support in BIND 9
    +
    IPv6 Support in BIND 9
    -
    Address Lookups Using AAAA Records
    -
    Address to Name Lookups Using Nibble Format
    +
    Address Lookups Using AAAA Records
    +
    Address to Name Lookups Using Nibble Format
    -
    +

    Notify

    DNS NOTIFY is a mechanism that allows master servers to notify their slave servers of changes to a zone's data. In - response to a NOTIFY from a master server, the + response to a NOTIFY from a master server, the slave will check to see that its version of the zone is the current version and, if not, initiate a zone transfer.

    For more information about DNS - NOTIFY, see the description of the - notify option in the section called “Boolean Options” and - the description of the zone option also-notify in - the section called “Zone Transfers”. The NOTIFY + NOTIFY, see the description of the + notify option in the section called “Boolean Options” and + the description of the zone option also-notify in + the section called “Zone Transfers”. The NOTIFY protocol is specified in RFC 1996.

    Note

    - As a slave zone can also be a master to other slaves, named, - by default, sends NOTIFY messages for every zone - it loads. Specifying notify master-only; will - cause named to only send NOTIFY for master +

    + As a slave zone can also be a master to other slaves, named, + by default, sends NOTIFY messages for every zone + it loads. Specifying notify master-only; will + cause named to only send NOTIFY for master zones that it loads. -

    +

    +
    -
    +

    Dynamic Update

    @@ -143,22 +143,22 @@

    Dynamic update is enabled by including an - allow-update or an update-policy - clause in the zone statement. + allow-update or an update-policy + clause in the zone statement.

    - If the zone's update-policy is set to + If the zone's update-policy is set to local, updates to the zone will be permitted for the key local-ddns, - which will be generated by named at startup. - See the section called “Dynamic Update Policies” for more details. + which will be generated by named at startup. + See the section called “Dynamic Update Policies” for more details.

    Dynamic updates using Kerberos signed requests can be made using the TKEY/GSS protocol by setting either the - tkey-gssapi-keytab option, or alternatively - by setting both the tkey-gssapi-credential - and tkey-domain options. Once enabled, + tkey-gssapi-keytab option, or alternatively + by setting both the tkey-gssapi-credential + and tkey-domain options. Once enabled, Kerberos signed requests will be matched against the update policies for the zone, using the Kerberos principal as the signer for the request. @@ -170,7 +170,7 @@ zone key. Update authorization is based on transaction signatures and an explicit server policy.

    -
    +

    The journal file

    @@ -212,37 +212,37 @@ hand because they are not guaranteed to contain the most recent dynamic changes — those are only in the journal file. The only way to ensure that the zone file of a dynamic zone - is up to date is to run rndc stop. + is up to date is to run rndc stop.

    If you have to make changes to a dynamic zone manually, the following procedure will work: Disable dynamic updates to the zone using - rndc freeze zone. + rndc freeze zone. This will update the zone's master file with the changes stored in its .jnl file. Edit the zone file. Run - rndc thaw zone + rndc thaw zone to reload the changed zone and re-enable dynamic updates.

    - rndc sync zone + rndc sync zone will update the zone file with changes from the journal file without stopping dynamic updates; this may be useful for viewing the current zone state. To remove the .jnl file after updating the zone file, use - rndc sync -clean. + rndc sync -clean.

    -
    +

    Incremental Zone Transfers (IXFR)

    The incremental zone transfer (IXFR) protocol is a way for slave servers to transfer only changed data, instead of having to transfer the entire zone. The IXFR protocol is specified in RFC - 1995. See Proposed Standards. + 1995. See Proposed Standards.

    When acting as a master, BIND 9 @@ -252,20 +252,20 @@ whose data was obtained by IXFR. For manually maintained master zones, and for slave zones obtained by performing a full zone transfer (AXFR), IXFR is supported only if the option - ixfr-from-differences is set + ixfr-from-differences is set to yes.

    When acting as a slave, BIND 9 will attempt to use IXFR unless it is explicitly disabled. For more information about disabling - IXFR, see the description of the request-ixfr clause - of the server statement. + IXFR, see the description of the request-ixfr clause + of the server statement.

    -
    +

    -Split DNS

    +Split DNS

    Setting up different views, or visibility, of the DNS space to internal and external resolvers is usually referred to as a @@ -293,126 +293,126 @@ on the Internet. Split DNS can also be used to allow mail from outside back in to the internal network.

    -
    +

    -Example split DNS setup

    -

    - Let's say a company named Example, Inc. - (example.com) - has several corporate sites that have an internal network with - reserved - Internet Protocol (IP) space and an external demilitarized zone (DMZ), - or "outside" section of a network, that is available to the public. -

    +Example split DNS setup
    +

    + Let's say a company named Example, Inc. + (example.com) + has several corporate sites that have an internal network with + reserved + Internet Protocol (IP) space and an external demilitarized zone (DMZ), + or "outside" section of a network, that is available to the public. +

    - Example, Inc. wants its internal clients - to be able to resolve external hostnames and to exchange mail with - people on the outside. The company also wants its internal resolvers - to have access to certain internal-only zones that are not available - at all outside of the internal network. -

    + Example, Inc. wants its internal clients + to be able to resolve external hostnames and to exchange mail with + people on the outside. The company also wants its internal resolvers + to have access to certain internal-only zones that are not available + at all outside of the internal network. +

    - In order to accomplish this, the company will set up two sets - of name servers. One set will be on the inside network (in the - reserved - IP space) and the other set will be on bastion hosts, which are - "proxy" - hosts that can talk to both sides of its network, in the DMZ. -

    + In order to accomplish this, the company will set up two sets + of name servers. One set will be on the inside network (in the + reserved + IP space) and the other set will be on bastion hosts, which are + "proxy" + hosts that can talk to both sides of its network, in the DMZ. +

    - The internal servers will be configured to forward all queries, - except queries for site1.internal, site2.internal, site1.example.com, - and site2.example.com, to the servers - in the - DMZ. These internal servers will have complete sets of information - for site1.example.com, site2.example.com, site1.internal, - and site2.internal. -

    + The internal servers will be configured to forward all queries, + except queries for site1.internal, site2.internal, site1.example.com, + and site2.example.com, to the servers + in the + DMZ. These internal servers will have complete sets of information + for site1.example.com, site2.example.com, site1.internal, + and site2.internal. +

    - To protect the site1.internal and site2.internal domains, - the internal name servers must be configured to disallow all queries - to these domains from any external hosts, including the bastion - hosts. -

    + To protect the site1.internal and site2.internal domains, + the internal name servers must be configured to disallow all queries + to these domains from any external hosts, including the bastion + hosts. +

    - The external servers, which are on the bastion hosts, will - be configured to serve the "public" version of the site1 and site2.example.com zones. - This could include things such as the host records for public servers - (www.example.com and ftp.example.com), - and mail exchange (MX) records (a.mx.example.com and b.mx.example.com). -

    + The external servers, which are on the bastion hosts, will + be configured to serve the "public" version of the site1 and site2.example.com zones. + This could include things such as the host records for public servers + (www.example.com and ftp.example.com), + and mail exchange (MX) records (a.mx.example.com and b.mx.example.com). +

    - In addition, the public site1 and site2.example.com zones - should have special MX records that contain wildcard (`*') records - pointing to the bastion hosts. This is needed because external mail - servers do not have any other way of looking up how to deliver mail - to those internal hosts. With the wildcard records, the mail will - be delivered to the bastion host, which can then forward it on to - internal hosts. -

    + In addition, the public site1 and site2.example.com zones + should have special MX records that contain wildcard (`*') records + pointing to the bastion hosts. This is needed because external mail + servers do not have any other way of looking up how to deliver mail + to those internal hosts. With the wildcard records, the mail will + be delivered to the bastion host, which can then forward it on to + internal hosts. +

    - Here's an example of a wildcard MX record: -

    + Here's an example of a wildcard MX record: + 

    *   IN MX 10 external1.example.com.

    - Now that they accept mail on behalf of anything in the internal - network, the bastion hosts will need to know how to deliver mail - to internal hosts. In order for this to work properly, the resolvers - on - the bastion hosts will need to be configured to point to the internal - name servers for DNS resolution. -

    + Now that they accept mail on behalf of anything in the internal + network, the bastion hosts will need to know how to deliver mail + to internal hosts. In order for this to work properly, the resolvers + on + the bastion hosts will need to be configured to point to the internal + name servers for DNS resolution. +

    - Queries for internal hostnames will be answered by the internal - servers, and queries for external hostnames will be forwarded back - out to the DNS servers on the bastion hosts. -

    + Queries for internal hostnames will be answered by the internal + servers, and queries for external hostnames will be forwarded back + out to the DNS servers on the bastion hosts. +

    - In order for all this to work properly, internal clients will - need to be configured to query only the internal - name servers for DNS queries. This could also be enforced via - selective - filtering on the network. -

    + In order for all this to work properly, internal clients will + need to be configured to query only the internal + name servers for DNS queries. This could also be enforced via + selective + filtering on the network. +

    - If everything has been set properly, Example, Inc.'s - internal clients will now be able to: -

    -
      -
    • - Look up any hostnames in the site1 - and - site2.example.com zones. -
      • -
    • - Look up any hostnames in the site1.internal and - site2.internal domains. -
      • -
    • Look up any hostnames on the Internet.
      • -
    • Exchange mail with both internal and external people.
      • + If everything has been set properly, Example, Inc.'s + internal clients will now be able to: +

      +
        +
      • + Look up any hostnames in the site1 + and + site2.example.com zones. +
        • +
      • + Look up any hostnames in the site1.internal and + site2.internal domains. +
        • +
      • Look up any hostnames on the Internet.
        • +
      • Exchange mail with both internal and external people.

      - Hosts on the Internet will be able to: -

      -
        -
      • - Look up any hostnames in the site1 - and - site2.example.com zones. -
        • -
      • - Exchange mail with anyone in the site1 and - site2.example.com zones. -
        • + Hosts on the Internet will be able to: +

        +
          +
        • + Look up any hostnames in the site1 + and + site2.example.com zones. +
          • +
        • + Exchange mail with anyone in the site1 and + site2.example.com zones. +

        - Here is an example configuration for the setup we just - described above. Note that this is only configuration information; - for information on how to configure your zone files, see the section called “Sample Configurations”. -

        + Here is an example configuration for the setup we just + described above. Note that this is only configuration information; + for information on how to configure your zone files, see the section called “Sample Configurations”. +

        - Internal DNS server config: -

        + Internal DNS server config: + 

         
 acl internals { 172.16.72.0/24; 192.168.1.0/24; };
@@ -475,8 +475,8 @@ zone "site2.internal" {
 };

        - External (bastion host) DNS server config: -

        + External (bastion host) DNS server config: + 

         acl internals { 172.16.72.0/24; 192.168.1.0/24; };
 
@@ -512,9 +512,9 @@ zone "site2.example.com" {
 };

        - In the resolv.conf (or equivalent) on - the bastion host(s): -

        + In the resolv.conf (or equivalent) on + the bastion host(s): + 

         search ...
 nameserver 172.16.72.2
@@ -523,262 +523,286 @@ nameserver 172.16.72.4
    -
    +

    TSIG

    - This is a short guide to setting up Transaction SIGnatures - (TSIG) based transaction security in BIND. It describes changes - to the configuration file as well as what changes are required for - different features, including the process of creating transaction - keys and using transaction signatures with BIND. + TSIG (Transaction SIGnatures) is a mechanism for authenticating DNS + messages, originally specified in RFC 2845. It allows DNS messages + to be cryptographically signed using a shared secret. TSIG can + be used in any DNS transaction, as a way to restrict access to + certain server functions (e.g., recursive queries) to authorized + clients when IP-based access control is insufficient or needs to + be overridden, or as a way to ensure message authenticity when it + is critical to the integrity of the server, such as with dynamic + UPDATE messages or zone transfers from a master to a slave server.

    - BIND primarily supports TSIG for server - to server communication. - This includes zone transfer, notify, and recursive query messages. - Resolvers based on newer versions of BIND 8 have limited support - for TSIG. + This is a guide to setting up TSIG in BIND. + It describes the configuration syntax and the process of creating + TSIG keys.

    - TSIG can also be useful for dynamic update. A primary - server for a dynamic zone should control access to the dynamic - update service, but IP-based access control is insufficient. - The cryptographic access control provided by TSIG - is far superior. The nsupdate - program supports TSIG via the -k and - -y command line options or inline by use - of the key. + named supports TSIG for server-to-server + communication, and some of the tools included with + BIND support it for sending messages to + named: +

    +
      +
    • +nsupdate(1) supports TSIG via the + -k, -l and + -y command line options, or via + the key command when running + interactively. +
      • +
    • +dig(1) supports TSIG via the + -k and -y command + line options. +
      • +
    +

    -
    +

    -Generate Shared Keys for Each Pair of Hosts

    -

    - A shared secret is generated to be shared between host1 and host2. - An arbitrary key name is chosen: "host1-host2.". The key name must - be the same on both hosts. +Generating a Shared Key

    +

    + TSIG keys can be generated using the ddns-confgen + command; the output of the command is a key directive + suitable for inclusion in named.conf. The + key name and algorithm can be specified by command line parameters; + the defaults are "ddns-key" and HMAC-SHA256, respectively. By + default, the output of ddns-confgen also includes + additional configuration text for setting up dynamic DNS in + named; the -q suppresses + this. See ddns-confgen(8) for further details.

    -
    -

    -Automatic Generation

    -

    - The following command will generate a 128-bit (16 byte) HMAC-SHA256 - key as described above. Longer keys are better, but shorter keys - are easier to read. Note that the maximum key length is the digest - length, here 256 bits. -

    -

    - dnssec-keygen -a hmac-sha256 -b 128 -n HOST host1-host2. -

    -

    - The key is in the file Khost1-host2.+163+00000.private. - Nothing directly uses this file, but the base-64 encoded string - following "Key:" - can be extracted from the file and used as a shared secret: -

    -
    Key: La/E5CjG9O+os1jq0a2jdA==
    -

    - The string "La/E5CjG9O+os1jq0a2jdA==" can - be used as the shared secret. -

    -
    -
    -

    -Manual Generation

    - The shared secret is simply a random sequence of bits, encoded - in base-64. Most ASCII strings are valid base-64 strings (assuming - the length is a multiple of 4 and only valid characters are used), - so the shared secret can be manually generated. -

    -

    - Also, a known string can be run through mmencode or - a similar program to generate base-64 encoded data. -

    -
    -
    -
    -

    -Copying the Shared Secret to Both Machines

    + Any string which is a valid DNS name can be used as a key name. + For example, a key to be shared between servers called + host1 and host2 could + be called "host1-host2.", and this key could be generated using: +

    +
    +  $ ddns-confgen -q -k host1-host2. > host1-host2.key
+

    - This is beyond the scope of DNS. A secure transport mechanism - should be used. This could be secure FTP, ssh, telephone, etc. + This key may then be copied to both hosts. The key name and secret + must be identical on both hosts. + (Note: copying a shared secret from one server to another is beyond + the scope of the DNS. A secure transport mechanism should be used: + secure FTP, SSL, ssh, telephone, encrypted email, etc.)

    -
    +

    -Informing the Servers of the Key's Existence

    +Loading A New Key

    - Imagine host1 and host 2 - are - both servers. The following is added to each server's named.conf file: + For a key shared between servers called + host1 and host2, + the following could be added to each server's + named.conf file: 

    -key host1-host2. {
-  algorithm hmac-sha256;
-  secret "La/E5CjG9O+os1jq0a2jdA==";
+key "host1-host2." {
+        algorithm hmac-sha256;
+        secret "DAopyf1mhCbFVZw7pgmNPBoLUq8wEUT7UuPoLENP2HY=";
 };

    - The secret is the one generated above. Since this is a secret, it - is recommended that either named.conf be - non-world readable, or the key directive be added to a non-world - readable file that is included by named.conf. + (This is the same key generated above using + ddns-confgen.) +

    +

    + Since this text contains a secret, it + is recommended that either named.conf not be + world-readable, or that the key directive + be stored in a file which is not world-readable, and which is + included in named.conf via the + include directive.

    - At this point, the key is recognized. This means that if the - server receives a message signed by this key, it can verify the - signature. If the signature is successfully verified, the - response is signed by the same key. + Once a key has been added to named.conf and the + server has been restarted or reconfigured, the server can recognize + the key. If the server receives a message signed by the + key, it will be able to verify the signature. If the signature + is valid, the response will be signed using the same key. +

    +

    + TSIG keys that are known to a server can be listed using the + command rndc tsig-list.

    -
    +

    -Instructing the Server to Use the Key

    +Instructing the Server to Use a Key
    +

    + A server sending a request to another server must be told whether + to use a key, and if so, which key to use. +

    +

    + For example, a key may be specified for each server in the + masters statement in the definition of a + slave zone; in this case, all SOA QUERY messages, NOTIFY + messages, and zone transfer requests (AXFR or IXFR) will be + signed using the specified key. Keys may also be specified + in the also-notify statement of a master + or slave zone, causing NOTIFY messages to be signed using + the specified key. +

    - Since keys are shared between two hosts only, the server must - be told when keys are to be used. The following is added to the named.conf file - for host1, if the IP address of host2 is - 10.1.2.3: + Keys can also be specified in a server + directive. Adding the following on host1, + if the IP address of host2 is 10.1.2.3, would + cause all requests from host1 + to host2, including normal DNS queries, to be + signed using the host1-host2. key: 

     server 10.1.2.3 {
-  keys { host1-host2. ;};
+        keys { host1-host2. ;};
 };

    - Multiple keys may be present, but only the first is used. - This directive does not contain any secrets, so it may be in a - world-readable - file. + Multiple keys may be present in the keys + statement, but only the first one is used. As this directive does + not contain secrets, it can be used in a world-readable file.

    - If host1 sends a message that is a request - to that address, the message will be signed with the specified key. host1 will - expect any responses to signed messages to be signed with the same - key. + Requests sent by host2 to host1 + would not be signed, unless a similar + server directive were in host2's + configuration file.

    - A similar statement must be present in host2's - configuration file (with host1's address) for host2 to - sign request messages to host1. + Whenever any server sends a TSIG-signed DNS request, it will expect + the response to be signed with the same key. If a response is not + signed, or if the signature is not valid, the response will be + rejected.

    -
    +

    -TSIG Key Based Access Control

    +TSIG-Based Access Control

    - BIND allows IP addresses and ranges - to be specified in ACL - definitions and - allow-{ query | transfer | update } - directives. - This has been extended to allow TSIG keys also. The above key would - be denoted key host1-host2. + TSIG keys may be specified in ACL definitions and ACL directives + such as allow-query, allow-transfer + and allow-update. + The above key would be denoted in an ACL element as + key host1-host2.

    - An example of an allow-update directive would be: + An example of an allow-update directive using + a TSIG key: 

    -allow-update { key host1-host2. ;};
+allow-update { !{ !localnets; any; }; key host1-host2. ;};

    - This allows dynamic updates to succeed only if the request - was signed by a key named "host1-host2.". + This allows dynamic updates to succeed only if the UPDATE + request comes from an address in localnets, + and if it is signed using the + host1-host2. key.

    - See the section called “Dynamic Update Policies” for a discussion of - the more flexible update-policy statement. + See the section called “Dynamic Update Policies” for a discussion of + the more flexible update-policy statement.

    -
    +

    -Errors

    -

    - The processing of TSIG signed messages can result in - several errors. If a signed message is sent to a non-TSIG aware - server, a FORMERR (format error) will be returned, since the server will not - understand the record. This is a result of misconfiguration, - since the server must be explicitly configured to send a TSIG - signed message to a specific server. -

    -

    - If a TSIG aware server receives a message signed by an - unknown key, the response will be unsigned with the TSIG - extended error code set to BADKEY. If a TSIG aware server - receives a message with a signature that does not validate, the - response will be unsigned with the TSIG extended error code set - to BADSIG. If a TSIG aware server receives a message with a time - outside of the allowed range, the response will be signed with - the TSIG extended error code set to BADTIME, and the time values - will be adjusted so that the response can be successfully - verified. In any of these cases, the message's rcode (response code) is set to - NOTAUTH (not authenticated). +Errors

    +

    + Processing of TSIG-signed messages can result in several errors: +

    +
      +
    • + If a TSIG-aware server receives a message signed by an + unknown key, the response will be unsigned, with the TSIG + extended error code set to BADKEY. +
      • +
    • + If a TSIG-aware server receives a message from a known key + but with an invalid signature, the response will be unsigned, + with the TSIG extended error code set to BADSIG. +
      • +
    • + If a TSIG-aware server receives a message with a time + outside of the allowed range, the response will be signed, with + the TSIG extended error code set to BADTIME, and the time values + will be adjusted so that the response can be successfully + verified. +
      • +
    +

    + In all of the above cases, the server will return a response code + of NOTAUTH (not authenticated).

    -
    +

    -TKEY

    -

    TKEY - is a mechanism for automatically generating a shared secret - between two hosts. There are several "modes" of - TKEY that specify how the key is generated - or assigned. BIND 9 implements only one of - these modes, the Diffie-Hellman key exchange. Both hosts are - required to have a Diffie-Hellman KEY record (although this - record is not required to be present in a zone). The - TKEY process must use signed messages, - signed either by TSIG or SIG(0). The result of - TKEY is a shared secret that can be used to - sign messages with TSIG. TKEY can also be - used to delete shared secrets that it had previously - generated. +TKEY

    +

    + TKEY (Transaction KEY) is a mechanism for automatically negotiating + a shared secret between two hosts, originally specified in RFC 2930. +

    +

    + There are several TKEY "modes" that specify how a key is to be + generated or assigned. BIND 9 implements only + one of these modes: Diffie-Hellman key exchange. Both hosts are + required to have a KEY record with algorithm DH (though this + record is not required to be present in a zone).

    - The TKEY process is initiated by a - client - or server by sending a signed TKEY - query - (including any appropriate KEYs) to a TKEY-aware server. The - server response, if it indicates success, will contain a - TKEY record and any appropriate keys. - After - this exchange, both participants have enough information to - determine the shared secret; the exact process depends on the - TKEY mode. When using the - Diffie-Hellman - TKEY mode, Diffie-Hellman keys are - exchanged, - and the shared secret is derived by both participants. + The TKEY process is initiated by a client or server by sending + a query of type TKEY to a TKEY-aware server. The query must include + an appropriate KEY record in the additional section, and + must be signed using either TSIG or SIG(0) with a previously + established key. The server's response, if successful, will + contain a TKEY record in its answer section. After this transaction, + both participants will have enough information to calculate a + shared secret using Diffie-Hellman key exchange. The shared secret + can then be used by to sign subsequent transactions between the + two servers. +

    +

    + TSIG keys known by the server, including TKEY-negotiated keys, can + be listed using rndc tsig-list. +

    +

    + TKEY-negotiated keys can be deleted from a server using + rndc tsig-delete. This can also be done via + the TKEY protocol itself, by sending an authenticated TKEY query + specifying the "key deletion" mode.

    -
    +

    -SIG(0)

    +SIG(0)

    - BIND 9 partially supports DNSSEC SIG(0) - transaction signatures as specified in RFC 2535 and RFC 2931. - SIG(0) - uses public/private keys to authenticate messages. Access control + BIND partially supports DNSSEC SIG(0) + transaction signatures as specified in RFC 2535 and RFC 2931. + SIG(0) uses public/private keys to authenticate messages. Access control is performed in the same manner as TSIG keys; privileges can be - granted or denied based on the key name. + granted or denied in ACL directives based on the key name.

    When a SIG(0) signed message is received, it will only be - verified if the key is known and trusted by the server; the server - will not attempt to locate and/or validate the key. + verified if the key is known and trusted by the server. The + server will not attempt to recursively fetch or validate the + key.

    - SIG(0) signing of multiple-message TCP streams is not - supported. + SIG(0) signing of multiple-message TCP streams is not supported.

    The only tool shipped with BIND 9 that - generates SIG(0) signed messages is nsupdate. + generates SIG(0) signed messages is nsupdate.

    -
    +

    DNSSEC

    @@ -814,11 +838,11 @@ allow-update { key host1-host2. ;}; either be statically configured with this zone's zone key or the zone key of another zone above this one in the DNS tree.

    -
    +

    -Generating Keys

    +Generating Keys

    - The dnssec-keygen program is used to + The dnssec-keygen program is used to generate keys.

    @@ -826,7 +850,7 @@ allow-update { key host1-host2. ;}; zone keys will sign all other records in the zone, as well as the zone keys of any secure delegated zones. Zone keys must have the same name as the zone, a name type of - ZONE, and must be usable for + ZONE, and must be usable for authentication. It is recommended that zone keys use a cryptographic algorithm designated as "mandatory to implement" by the IETF; currently @@ -860,21 +884,21 @@ allow-update { key host1-host2. ;}; a different key tag), repeat the above command.

    - The dnssec-keyfromlabel program is used + The dnssec-keyfromlabel program is used to get a key pair from a crypto hardware and build the key - files. Its usage is similar to dnssec-keygen. + files. Its usage is similar to dnssec-keygen.

    The public keys should be inserted into the zone file by including the .key files using - $INCLUDE statements. + $INCLUDE statements.

    -
    +

    -Signing the Zone

    +Signing the Zone

    - The dnssec-signzone program is used + The dnssec-signzone program is used to sign a zone.

    @@ -904,7 +928,7 @@ allow-update { key host1-host2. ;}; as the input file for the zone.

    -

    dnssec-signzone +

    dnssec-signzone will also produce a keyset and dsset files and optionally a dlvset file. These are used to provide the parent zone administrators with the DNSKEYs (or their @@ -912,50 +936,50 @@ allow-update { key host1-host2. ;}; secure entry point to the zone.

    -
    +

    -Configuring Servers

    +Configuring Servers

    - To enable named to respond appropriately + To enable named to respond appropriately to DNS requests from DNSSEC aware clients, - dnssec-enable must be set to yes. + dnssec-enable must be set to yes. (This is the default setting.)

    - To enable named to validate answers from - other servers, the dnssec-enable option + To enable named to validate answers from + other servers, the dnssec-enable option must be set to yes, and the - dnssec-validation options must be set to + dnssec-validation options must be set to yes or auto.

    - If dnssec-validation is set to + If dnssec-validation is set to auto, then a default trust anchor for the DNS root zone will be used. If it is set to yes, however, then at least one trust anchor must be configured - with a trusted-keys or - managed-keys statement in + with a trusted-keys or + managed-keys statement in named.conf, or DNSSEC validation will not occur. The default setting is yes.

    - trusted-keys are copies of DNSKEY RRs + trusted-keys are copies of DNSKEY RRs for zones that are used to form the first link in the cryptographic chain of trust. All keys listed in - trusted-keys (and corresponding zones) + trusted-keys (and corresponding zones) are deemed to exist and only the listed keys will be used to validated the DNSKEY RRset that they are from.

    - managed-keys are trusted keys which are + managed-keys are trusted keys which are automatically kept up to date via RFC 5011 trust anchor maintenance.

    - trusted-keys and - managed-keys are described in more detail + trusted-keys and + managed-keys are described in more detail later in this document.

    @@ -970,7 +994,7 @@ allow-update { key host1-host2. ;}; more public keys for the root. This allows answers from outside the organization to be validated. It will also have several keys for parts of the namespace the organization - controls. These are here to ensure that named + controls. These are here to ensure that named is immune to compromises in the DNSSEC components of the security of parent zones.

    @@ -1028,9 +1052,11 @@ options {

    Note

    +

    None of the keys listed in this example are valid. In particular, the root key is not valid. -

    +

    +

    When DNSSEC validation is enabled and properly configured, the resolver will reject any answers from signed, secure zones @@ -1067,24 +1093,24 @@ options {

    -
    +

    DNSSEC, Dynamic Zones, and Automatic Signing

    As of BIND 9.7.0 it is possible to change a dynamic zone from insecure to signed and back again. A secure zone can use either NSEC or NSEC3 chains.

    -

    -Converting from insecure to secure

    +

    +Converting from insecure to secure

    Changing a zone from insecure to secure can be done in two - ways: using a dynamic DNS update, or the - auto-dnssec zone option.

    -

    For either method, you need to configure - named so that it can see the + ways: using a dynamic DNS update, or the + auto-dnssec zone option.

    +

    For either method, you need to configure + named so that it can see the K* files which contain the public and private parts of the keys that will be used to sign the zone. These files - will have been generated by - dnssec-keygen. You can do this by placing them - in the key-directory, as specified in + will have been generated by + dnssec-keygen. You can do this by placing them + in the key-directory, as specified in named.conf:

             zone example.net {
@@ -1099,8 +1125,8 @@ options {
   with the ZSK, and the DNSKEY RRset to be signed with the KSK as
   well. An NSEC chain will be generated as part of the initial
   signing process.
    
-
    
-Dynamic DNS update method
    
+
    
+Dynamic DNS update method
    
 
    To insert the keys via dynamic update:
    
 
             % nsupdate
@@ -1110,8 +1136,8 @@ options {
         > send
 
    
 
    While the update request will complete almost immediately,
-  the zone will not be completely signed until 
-  named has had time to walk the zone and
+  the zone will not be completely signed until
+  named has had time to walk the zone and
   generate the NSEC and RRSIG records. The NSEC record at the apex
   will be added last, to signal that there is a complete NSEC
   chain.
    
@@ -1128,49 +1154,49 @@ options {
         > send

    Again, this update request will complete almost - immediately; however, the record won't show up until - named has had a chance to build/remove the + immediately; however, the record won't show up until + named has had a chance to build/remove the relevant chain. A private type record will be created to record the state of the operation (see below for more details), and will be removed once the operation completes.

    While the initial signing and NSEC/NSEC3 chain generation is happening, other updates are possible as well.

    -

    -Fully automatic zone signing

    -

    To enable automatic signing, add the - auto-dnssec option to the zone statement in - named.conf. - auto-dnssec has two possible arguments: - allow or +

    +Fully automatic zone signing

    +

    To enable automatic signing, add the + auto-dnssec option to the zone statement in + named.conf. + auto-dnssec has two possible arguments: + allow or maintain.

    -

    With - auto-dnssec allow, - named can search the key directory for keys +

    With + auto-dnssec allow, + named can search the key directory for keys matching the zone, insert them into the zone, and use them to - sign the zone. It will do so only when it receives an - rndc sign <zonename>.

    + sign the zone. It will do so only when it receives an + rndc sign <zonename>.

    - auto-dnssec maintain includes the above + auto-dnssec maintain includes the above functionality, but will also automatically adjust the zone's DNSKEY records on schedule according to the keys' timing metadata. - (See dnssec-keygen(8) and - dnssec-settime(8) for more information.) + (See dnssec-keygen(8) and + dnssec-settime(8) for more information.)

    - named will periodically search the key directory + named will periodically search the key directory for keys matching the zone, and if the keys' metadata indicates that any change should be made the zone, such as adding, removing, or revoking a key, then that action will be carried out. By default, the key directory is checked for changes every 60 minutes; this period can be adjusted with the dnssec-loadkeys-interval, up - to a maximum of 24 hours. The rndc loadkeys forces - named to check for key updates immediately. + to a maximum of 24 hours. The rndc loadkeys forces + named to check for key updates immediately.

    If keys are present in the key directory the first time the zone - is loaded, the zone will be signed immediately, without waiting for an - rndc sign or rndc loadkeys + is loaded, the zone will be signed immediately, without waiting for an + rndc sign or rndc loadkeys command. (Those commands can still be used when there are unscheduled key changes, however.)

    @@ -1178,7 +1204,7 @@ options { When new keys are added to a zone, the TTL is set to match that of any existing DNSKEY RRset. If there is no existing DNSKEY RRset, then the TTL will be set to the TTL specified when the key was - created (using the dnssec-keygen -L option), if + created (using the dnssec-keygen -L option), if any, or to the SOA TTL.

    @@ -1191,15 +1217,15 @@ options { the zone is signed and the NSEC3 chain is completed, the NSEC3PARAM record will appear in the zone.

    -

    Using the - auto-dnssec option requires the zone to be - configured to allow dynamic updates, by adding an - allow-update or - update-policy statement to the zone +

    Using the + auto-dnssec option requires the zone to be + configured to allow dynamic updates, by adding an + allow-update or + update-policy statement to the zone configuration. If this has not been done, the configuration will fail.

    -

    -Private-type records

    +

    +Private-type records

    The state of the signing process is signaled by private-type records (with a default type value of 65534). When signing is complete, these records will have a nonzero value for @@ -1239,18 +1265,18 @@ options {

    -

    -DNSKEY rollovers

    +

    +DNSKEY rollovers

    As with insecure-to-secure conversions, rolling DNSSEC - keys can be done in two ways: using a dynamic DNS update, or the - auto-dnssec zone option.

    -

    -Dynamic DNS update method

    + keys can be done in two ways: using a dynamic DNS update, or the + auto-dnssec zone option.

    +

    +Dynamic DNS update method

    To perform key rollovers via dynamic update, you need to add - the K* files for the new keys so that - named can find them. You can then add the new - DNSKEY RRs via dynamic update. - named will then cause the zone to be signed + the K* files for the new keys so that + named can find them. You can then add the new + DNSKEY RRs via dynamic update. + named will then cause the zone to be signed with the new keys. When the signing is complete the private type records will be updated so that the last octet is non zero.

    @@ -1263,15 +1289,15 @@ options { be able to verify at least one signature when you remove the old DNSKEY.

    The old DNSKEY can be removed via UPDATE. Take care to - specify the correct key. - named will clean out any signatures generated + specify the correct key. + named will clean out any signatures generated by the old key after the update completes.

    -

    -Automatic key rollovers

    +

    +Automatic key rollovers

    When a new key reaches its activation date (as set by - dnssec-keygen or dnssec-settime), - if the auto-dnssec zone option is set to - maintain, named will + dnssec-keygen or dnssec-settime), + if the auto-dnssec zone option is set to + maintain, named will automatically carry out the key rollover. If the key's algorithm has not previously been used to sign the zone, then the zone will be fully signed as quickly as possible. However, if the new key @@ -1281,83 +1307,82 @@ options { signature validity periods expire. By default, this rollover completes in 30 days, after which it will be safe to remove the old key from the DNSKEY RRset.

    -

    -NSEC3PARAM rollovers via UPDATE

    +

    +NSEC3PARAM rollovers via UPDATE

    Add the new NSEC3PARAM record via dynamic update. When the new NSEC3 chain has been generated, the NSEC3PARAM flag field will be zero. At this point you can remove the old NSEC3PARAM record. The old chain will be removed after the update request completes.

    -

    -Converting from NSEC to NSEC3

    +

    +Converting from NSEC to NSEC3

    To do this, you just need to add an NSEC3PARAM record. When the conversion is complete, the NSEC chain will have been removed and the NSEC3PARAM record will have a zero flag field. The NSEC3 chain will be generated before the NSEC chain is destroyed.

    -

    -Converting from NSEC3 to NSEC

    -

    To do this, use nsupdate to +

    +Converting from NSEC3 to NSEC

    +

    To do this, use nsupdate to remove all NSEC3PARAM records with a zero flag field. The NSEC chain will be generated before the NSEC3 chain is removed.

    -

    -Converting from secure to insecure

    +

    +Converting from secure to insecure

    To convert a signed zone to unsigned using dynamic DNS, delete all the DNSKEY records from the zone apex using - nsupdate. All signatures, NSEC or NSEC3 chains, + nsupdate. All signatures, NSEC or NSEC3 chains, and associated NSEC3PARAM records will be removed automatically. This will take place after the update request completes.

    -

    This requires the - dnssec-secure-to-insecure option to be set to - yes in +

    This requires the + dnssec-secure-to-insecure option to be set to + yes in named.conf.

    -

    In addition, if the auto-dnssec maintain +

    In addition, if the auto-dnssec maintain zone statement is used, it should be removed or changed to - allow instead (or it will re-sign). + allow instead (or it will re-sign).

    -

    -Periodic re-signing

    +

    +Periodic re-signing

    In any secure zone which supports dynamic updates, named will periodically re-sign RRsets which have not been re-signed as a result of some update action. The signature lifetimes will be adjusted so as to spread the re-sign load over time rather than all at once.

    -

    -NSEC3 and OPTOUT

    +

    +NSEC3 and OPTOUT

    - named only supports creating new NSEC3 chains + named only supports creating new NSEC3 chains where all the NSEC3 records in the zone have the same OPTOUT - state. - named supports UPDATES to zones where the NSEC3 - records in the chain have mixed OPTOUT state. - named does not support changing the OPTOUT + state. + named supports UPDATES to zones where the NSEC3 + records in the chain have mixed OPTOUT state. + named does not support changing the OPTOUT state of an individual NSEC3 record, the entire chain needs to be changed if the OPTOUT state of an individual NSEC3 needs to be changed.

    -
    +

    Dynamic Trust Anchor Management

    BIND 9.7.0 introduces support for RFC 5011, dynamic trust - anchor management. Using this feature allows - named to keep track of changes to critical + anchor management. Using this feature allows + named to keep track of changes to critical DNSSEC keys without any need for the operator to make changes to configuration files.

    -
    +

    -Validating Resolver

    +Validating Resolver

    To configure a validating resolver to use RFC 5011 to - maintain a trust anchor, configure the trust anchor using a - managed-keys statement. Information about - this can be found in - the section called “managed-keys Statement Definition + maintain a trust anchor, configure the trust anchor using a + managed-keys statement. Information about + this can be found in + the section called “managed-keys Statement Definition and Usage”.

    -
    +

    -Authoritative Server

    +Authoritative Server

    To set up an authoritative zone for RFC 5011 trust anchor maintenance, generate two (or more) key signing keys (KSKs) for the zone. Sign the zone with one of them; this is the "active" @@ -1373,21 +1398,21 @@ options { timer has completed, the active KSK can be revoked, and the zone can be "rolled over" to the newly accepted key.

    The easiest way to place a stand-by key in a zone is to - use the "smart signing" features of - dnssec-keygen and - dnssec-signzone. If a key with a publication + use the "smart signing" features of + dnssec-keygen and + dnssec-signzone. If a key with a publication date in the past, but an activation date which is unset or in - the future, " - dnssec-signzone -S" will include the DNSKEY + the future, " + dnssec-signzone -S" will include the DNSKEY record in the zone, but will not sign with it:

     $ dnssec-keygen -K keys -f KSK -P now -A now+2y example.net
 $ dnssec-signzone -S -K keys example.net
    -

    To revoke a key, the new command - dnssec-revoke has been added. This adds the - REVOKED bit to the key flags and re-generates the - K*.key and +

    To revoke a key, the new command + dnssec-revoke has been added. This adds the + REVOKED bit to the key flags and re-generates the + K*.key and K*.private files.

    After revoking the active key, the zone must be signed with both the revoked KSK and the new active KSK. (Smart @@ -1405,8 +1430,8 @@ $ dnssec-signzone -S -K keys example.net< "Kexample.com.+005+10128".

    If two keys have ID's exactly 128 apart, and one is revoked, then the two key ID's will collide, causing several - problems. To prevent this, - dnssec-keygen will not generate a new key if + problems. To prevent this, + dnssec-keygen will not generate a new key if another key is present which may collide. This checking will only occur if the new keys are written to the same directory which holds all other keys in use for that zone.

    @@ -1419,7 +1444,7 @@ $ dnssec-signzone -S -K keys example.net< keys with their original unrevoked key ID's.

    -
    +

    PKCS #11 (Cryptoki) support

    PKCS #11 (Public Key Cryptography Standard #11) defines a @@ -1429,9 +1454,9 @@ $ dnssec-signzone -S -K keys example.net< cryptographic acceleration board, tested under Solaris x86, and the AEP Keyper network-attached key storage device, tested with Debian Linux, Solaris x86 and Windows Server 2003.

    -
    +

    -Prerequisites

    +Prerequisites

    See the HSM vendor documentation for information about installing, initializing, testing and troubleshooting the HSM.

    @@ -1450,12 +1475,12 @@ $ dnssec-signzone -S -K keys example.net< the patched OpenSSL, one of which must be chosen at configuration time. The correct choice depends on the HSM hardware:

    -
      -

    • Use 'crypto-accelerator' with HSMs that have hardware +

        +

      • Use 'crypto-accelerator' with HSMs that have hardware cryptographic acceleration features, such as the SCA 6000 board. This causes OpenSSL to run all supported cryptographic operations in the HSM.

        • -

      • Use 'sign-only' with HSMs that are designed to +

      • Use 'sign-only' with HSMs that are designed to function primarily as secure key storage devices, but lack hardware acceleration. These devices are highly secure, but are not necessarily any faster at cryptography than the @@ -1469,16 +1494,16 @@ $ dnssec-signzone -S -K keys example.net<

        The modified OpenSSL code is included in the BIND 9 release, in the form of a context diff against the latest versions of - OpenSSL. OpenSSL 0.9.8, 1.0.0, and 1.0.1 are supported; there are - separate diffs for each version. In the examples to follow, - we use OpenSSL 0.9.8, but the same methods work with OpenSSL - 1.0.0 and 1.0.1. + OpenSSL. OpenSSL 0.9.8, 1.0.0, 1.0.1 and 1.0.2 are supported; + there are separate diffs for each version. In the examples to + follow, we use OpenSSL 0.9.8, but the same methods work with + OpenSSL 1.0.0 through 1.0.2.

        Note

        - The latest OpenSSL versions at the time of the BIND release - are 0.9.8y, 1.0.0k and 1.0.1e. - ISC will provide an updated patch as new versions of OpenSSL + The OpenSSL patches as of this writing (January 2016) + support versions 0.9.8zh, 1.0.0t, 1.0.1q and 1.0.2f. + ISC will provide updated patches as new versions of OpenSSL are released. The version number in the following examples is expected to change.

        @@ -1488,7 +1513,7 @@ $ dnssec-signzone -S -K keys example.net< library.

        Obtain OpenSSL 0.9.8s:

        -$ wget http://www.openssl.org/source/openssl-0.9.8s.tar.gz
+$ wget http://www.openssl.org/source/openssl-0.9.8s.tar.gz

        Extract the tarball:

        @@ -1508,9 +1533,9 @@ $ patch -p1 -d openssl-0.9.8s \
     elsewhere on the system. In the following examples, we choose
     to install into "/opt/pkcs11/usr". We will use this location
     when we configure BIND 9.
        
-
        
+
        
 
        
-Building OpenSSL for the AEP Keyper on Linux
        
+Building OpenSSL for the AEP Keyper on Linux

      The AEP Keyper is a highly secure key storage device, but does not provide hardware cryptographic acceleration. It can carry out cryptographic operations, but it is probably @@ -1535,14 +1560,14 @@ $ ./Configure linux-generic32 -m32 -pthread \ --pk11-flavor=sign-only \ --prefix=/opt/pkcs11/usr -

      After configuring, run "make" - and "make test". If "make +

      After configuring, run "make" + and "make test". If "make test" fails with "pthread_atfork() not found", you forgot to add the -pthread above.

    -
    +

    -Building OpenSSL for the SCA 6000 on Solaris

    +Building OpenSSL for the SCA 6000 on Solaris

    The SCA-6000 PKCS #11 provider is installed as a system library, libpkcs11. It is a true crypto accelerator, up to 4 times faster than any CPU, so the flavor shall be @@ -1558,13 +1583,13 @@ $ ./Configure solaris64-x86_64-cc \

    (For a 32-bit build, use "solaris-x86-cc" and /usr/lib/libpkcs11.so.)

    -

    After configuring, run - make and - make test.

    +

    After configuring, run + make and + make test.

    -
    +

    -Building OpenSSL for SoftHSM

    +Building OpenSSL for SoftHSM

    SoftHSM is a software library provided by the OpenDNSSEC project (http://www.opendnssec.org) which provides a PKCS#11 interface to a virtual HSM, implemented in the form of encrypted @@ -1597,11 +1622,11 @@ $ ./Configure linux-x86_64 -pthread \ --pk11-flavor=sign-only \ --prefix=/opt/pkcs11/usr -

    After configuring, run "make" - and "make test".

    +

    After configuring, run "make" + and "make test".

    Once you have built OpenSSL, run - "apps/openssl engine pkcs11" to confirm + "apps/openssl engine pkcs11" to confirm that PKCS #11 support was compiled in correctly. The output should be one of the following lines, depending on the flavor selected:

    @@ -1613,23 +1638,23 @@ $ ./Configure linux-x86_64 -pthread \ (pkcs11) PKCS #11 engine support (crypto accelerator)

    Next, run - "apps/openssl engine pkcs11 -t". This will + "apps/openssl engine pkcs11 -t". This will attempt to initialize the PKCS #11 engine. If it is able to do so successfully, it will report - “[ available ]”.

    + “[ available ]”.

    If the output is correct, run - "make install" which will install the - modified OpenSSL suite to + "make install" which will install the + modified OpenSSL suite to /opt/pkcs11/usr.

    -
    +

    -Building BIND 9 with PKCS#11

    +Building BIND 9 with PKCS#11

    When building BIND 9, the location of the custom-built OpenSSL library must be specified via configure.

    -
    +

    -Configuring BIND 9 for Linux with the AEP Keyper

    +Configuring BIND 9 for Linux with the AEP Keyper

    To link with the PKCS #11 provider, threads must be enabled in the BIND 9 build.

    The PKCS #11 library for the AEP Keyper is currently @@ -1643,9 +1668,9 @@ $ ./configure CC="gcc -m32" --enable-threads \ --with-pkcs11=/opt/pkcs11/usr/lib/libpkcs11.so

    -
    +

    -Configuring BIND 9 for Solaris with the SCA 6000

    +Configuring BIND 9 for Solaris with the SCA 6000

    To link with the PKCS #11 provider, threads must be enabled in the BIND 9 build.

    @@ -1661,9 +1686,9 @@ $ ./configure CC="cc -xarch=amd64" --enable-thre
       same as the --prefix argument to the OpenSSL
       Configure).
    -
    +

    -Configuring BIND 9 for SoftHSM

    +Configuring BIND 9 for SoftHSM
     $ cd ../bind9
 $ ./configure --enable-threads \
@@ -1672,22 +1697,22 @@ $ ./configure --enable-threads \

    After configuring, run - "make", - "make test" and - "make install".

    + "make", + "make test" and + "make install".

    (Note: If "make test" fails in the "pkcs11" system test, you may have forgotten to set the SOFTHSM_CONF environment variable.)

    -
    +

    -PKCS #11 Tools

    +PKCS #11 Tools

    BIND 9 includes a minimal set of tools to operate the - HSM, including - pkcs11-keygen to generate a new key pair - within the HSM, - pkcs11-list to list objects currently - available, and - pkcs11-destroy to remove objects.

    + HSM, including + pkcs11-keygen to generate a new key pair + within the HSM, + pkcs11-list to list objects currently + available, and + pkcs11-destroy to remove objects.

    In UNIX/Linux builds, these tools are built only if BIND 9 is configured with the --with-pkcs11 option. (NOTE: If --with-pkcs11 is set to "yes", rather than to the path of the @@ -1696,9 +1721,9 @@ $ ./configure --enable-threads \ PKCS11_PROVIDER environment variable to specify the path to the provider.)

    -
    +

    -Using the HSM

    +Using the HSM

    First, we must set up the runtime environment so the OpenSSL and PKCS #11 libraries can be loaded:

    @@ -1707,22 +1732,22 @@ $ export LD_LIBRARY_PATH=/opt/pkcs11/usr/lib:${L
 
    When operating an AEP Keyper, it is also necessary to
     specify the location of the "machine" file, which stores
     information about the Keyper for use by PKCS #11 provider
-    library. If the machine file is in 
+    library. If the machine file is in
     /opt/Keyper/PKCS11Provider/machine,
     use:
    
 
     $ export KEYPER_LIBRARY_PATH=/opt/Keyper/PKCS11Provider
 
    
 
    These environment variables must be set whenever running
-    any tool that uses the HSM, including 
-    pkcs11-keygen, 
-    pkcs11-list, 
-    pkcs11-destroy, 
-    dnssec-keyfromlabel, 
-    dnssec-signzone, 
-    dnssec-keygen(which will use the HSM for
-    random number generation), and 
-    named.
    
+    any tool that uses the HSM, including
+    pkcs11-keygen,
+    pkcs11-list,
+    pkcs11-destroy,
+    dnssec-keyfromlabel,
+    dnssec-signzone,
+    dnssec-keygen(which will use the HSM for
+    random number generation), and
+    named.
    
 
    We can now create and use keys in the HSM. In this case,
     we will create a 2048 bit key and give it the label
     "sample-ksk":
    
@@ -1769,9 +1794,9 @@ $ dnssec-keygen example.net
     rolled more frequently, if you wish, to compensate for a
     reduction in key security.
    
 
    Now you can sign the zone. (Note: If not using the -S
-    option to 
-    dnssec-signzone, it will be necessary to add
-    the contents of both 
+    option to
+    dnssec-signzone, it will be necessary to add
+    the contents of both
     K*.key files to the zone master file before
     signing it.)
    
 
    @@ -1784,12 +1809,12 @@ Algorithm: NSEC3RSASHA1: ZSKs: 1, KSKs: 1 active, 0 revoked, 0 stand-by
 example.net.signed
    -
    +

    -Specifying the engine on the command line

    -

    The OpenSSL engine can be specified in - named and all of the BIND - dnssec-* tools by using the "-E +Specifying the engine on the command line

    +

    The OpenSSL engine can be specified in + named and all of the BIND + dnssec-* tools by using the "-E <engine>" command line option. If BIND 9 is built with the --with-pkcs11 option, this option defaults to "pkcs11". Specifying the engine will generally not be necessary unless @@ -1801,19 +1826,19 @@ example.net.signed 

     $ dnssec-signzone -E '' -S example.net
    -

    This causes - dnssec-signzone to run as if it were compiled +

    This causes + dnssec-signzone to run as if it were compiled without the --with-pkcs11 option.

    -
    +

    -Running named with automatic zone re-signing

    -

    If you want - named to dynamically re-sign zones using HSM +Running named with automatic zone re-signing

    +

    If you want + named to dynamically re-sign zones using HSM keys, and/or to to sign new records inserted via nsupdate, then named must have access to the HSM PIN. This can be accomplished by placing the PIN into the openssl.cnf file (in the above - examples, + examples, /opt/pkcs11/usr/ssl/openssl.cnf).

    The location of the openssl.cnf file can be overridden by setting the OPENSSL_CONF environment variable before running @@ -1841,9 +1866,9 @@ $ dnssec-signzone -E '' -S example.net

    -
    +

    -IPv6 Support in BIND 9

    +IPv6 Support in BIND 9

    BIND 9 fully supports all currently defined forms of IPv6 name to address and address to name @@ -1877,11 +1902,11 @@ $ dnssec-signzone -E '' -S example.net

    For an overview of the format and structure of IPv6 addresses, - see the section called “IPv6 addresses (AAAA)”. + see the section called “IPv6 addresses (AAAA)”.

    -
    +

    -Address Lookups Using AAAA Records

    +Address Lookups Using AAAA Records

    The IPv6 AAAA record is a parallel to the IPv4 A record, and, unlike the deprecated A6 record, specifies the entire @@ -1898,9 +1923,9 @@ host 3600 IN AAAA 2001:db8::1 the address.

    -
    +

    -Address to Name Lookups Using Nibble Format

    +Address to Name Lookups Using Nibble Format

    When looking up an address in nibble format, the address components are simply reversed, just as in IPv4, and @@ -1935,6 +1960,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.

    -

    BIND 9.9.8-P4 (Extended Support Version)

    +

    BIND 9.9.9-P3 (Extended Support Version)

    diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch05.html b/contrib/bind9/doc/arm/Bv9ARM.ch05.html index 55d3be0c8..17ddab0c8 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch05.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch05.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Chapter 5. The BIND 9 Lightweight Resolver - - + + @@ -39,19 +38,19 @@
    -
    -

    -Chapter 5. The BIND 9 Lightweight Resolver

    +
    +

    +Chapter 5. The BIND 9 Lightweight Resolver

    Table of Contents

    -
    -
    The Lightweight Resolver Library
    -
    Running a Resolver Daemon
    +
    +
    The Lightweight Resolver Library
    +
    Running a Resolver Daemon
    -
    +

    -The Lightweight Resolver Library

    +The Lightweight Resolver Library

    Traditionally applications have been linked with a stub resolver library that sends recursive DNS queries to a local caching name @@ -73,14 +72,14 @@ that is distinct from and simpler than the full DNS protocol.

    -
    +

    Running a Resolver Daemon

    To use the lightweight resolver interface, the system must - run the resolver daemon lwresd or a + run the resolver daemon lwresd or a local - name server configured with a lwres + name server configured with a lwres statement.

    @@ -88,7 +87,7 @@ make UDP requests to the IPv4 loopback address (127.0.0.1) on port 921. The - address can be overridden by lwserver + address can be overridden by lwserver lines in /etc/resolv.conf.

    @@ -98,27 +97,27 @@ NIS, etc.

    - The lwresd daemon is essentially a + The lwresd daemon is essentially a caching-only name server that responds to requests using the lightweight resolver protocol rather than the DNS protocol. Because it needs to run on each host, it is designed to require no or minimal configuration. Unless configured otherwise, it uses the name servers listed on - nameserver lines in /etc/resolv.conf + nameserver lines in /etc/resolv.conf as forwarders, but is also capable of doing the resolution autonomously if none are specified.

    - The lwresd daemon may also be + The lwresd daemon may also be configured with a named.conf style configuration file, in /etc/lwresd.conf by default. A name server may also be configured to act as a lightweight resolver daemon using the - lwres statement in named.conf. + lwres statement in named.conf.

    @@ -139,6 +138,6 @@
    -

    BIND 9.9.8-P4 (Extended Support Version)

    +

    BIND 9.9.9-P3 (Extended Support Version)

    diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch06.html b/contrib/bind9/doc/arm/Bv9ARM.ch06.html index 1d353986f..51e7f755e 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch06.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch06.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Chapter 6. BIND 9 Configuration Reference - - + + @@ -39,71 +38,72 @@
    -
    -

    -Chapter 6. BIND 9 Configuration Reference

    +
    +

    +Chapter 6. BIND 9 Configuration Reference

    Table of Contents

    -
    -
    Configuration File Elements
    +
    +
    Configuration File Elements
    -
    Address Match Lists
    -
    Comment Syntax
    +
    Address Match Lists
    +
    Comment Syntax
    -
    Configuration File Grammar
    +
    Configuration File Grammar
    -
    acl Statement Grammar
    -
    acl Statement Definition and +
    acl Statement Grammar
    +
    acl Statement Definition and Usage
    -
    controls Statement Grammar
    -
    controls Statement Definition and +
    controls Statement Grammar
    +
    controls Statement Definition and Usage
    -
    include Statement Grammar
    -
    include Statement Definition and +
    include Statement Grammar
    +
    include Statement Definition and Usage
    +
    key Statement Grammar
    +
    key Statement Definition and Usage
    +
    logging Statement Grammar
    +
    logging Statement Definition and Usage
    +
    lwres Statement Grammar
    +
    lwres Statement Definition and Usage
    +
    masters Statement Grammar
    +
    masters Statement Definition and Usage
    -
    key Statement Grammar
    -
    key Statement Definition and Usage
    -
    logging Statement Grammar
    -
    logging Statement Definition and +
    options Statement Grammar
    +
    options Statement Definition and Usage
    -
    lwres Statement Grammar
    -
    lwres Statement Definition and Usage
    -
    masters Statement Grammar
    -
    masters Statement Definition and - Usage
    -
    options Statement Grammar
    -
    options Statement Definition and - Usage
    -
    server Statement Grammar
    -
    server Statement Definition and +
    server Statement Grammar
    +
    server Statement Definition and Usage
    -
    statistics-channels Statement Grammar
    -
    statistics-channels Statement Definition and +
    statistics-channels Statement Grammar
    +
    statistics-channels Statement Definition and Usage
    -
    trusted-keys Statement Grammar
    -
    trusted-keys Statement Definition +
    trusted-keys Statement Grammar
    +
    trusted-keys Statement Definition and Usage
    -
    managed-keys Statement Grammar
    -
    managed-keys Statement Definition +
    managed-keys Statement Grammar
    +
    managed-keys Statement Definition and Usage
    -
    view Statement Grammar
    -
    view Statement Definition and Usage
    -
    zone +
    view Statement Grammar
    +
    view Statement Definition and Usage
    +
    zone Statement Grammar
    -
    zone Statement Definition and Usage
    +
    zone Statement Definition and Usage
    -
    Zone File
    +
    Zone File
    -
    Types of Resource Records and When to Use Them
    -
    Discussion of MX Records
    -
    Setting TTLs
    -
    Inverse Mapping in IPv4
    -
    Other Zone File Directives
    -
    BIND Master File Extension: the $GENERATE Directive
    -
    Additional File Formats
    +
    Types of Resource Records and When to Use Them
    +
    Discussion of MX Records
    +
    Setting TTLs
    +
    Inverse Mapping in IPv4
    +
    Other Zone File Directives
    +
    BIND Master File Extension: the $GENERATE Directive
    +
    Additional File Formats
    +
    +
    BIND9 Statistics
    +
    +
    The Statistics File
    +
    Statistics Counters
    -
    BIND9 Statistics
    -
    Statistics Counters

    @@ -122,7 +122,7 @@ using the shell script contrib/named-bootconf/named-bootconf.sh.

    -
    +

    Configuration File Elements

    @@ -131,8 +131,8 @@

    --++ @@ -144,7 +144,7 @@ @@ -160,7 +160,7 @@ ip_addr, ip_prefix, key_id, or acl_name elements, see - the section called “Address Match Lists”. + the section called “Address Match Lists”.

    @@ -215,8 +215,8 @@ @@ -241,7 +241,7 @@

    The name of an address_match_list as - defined by the acl statement. + defined by the acl statement.

    One to four integers valued 0 through - 255 separated by dots (`.'), such as 123, - 45.67 or 89.123.45.67. + 255 separated by dots (`.'), such as 123, + 45.67 or 89.123.45.67.

    - An IPv6 address, such as 2001:db8::1234. + An IPv6 address, such as 2001:db8::1234. IPv6 scoped addresses that have ambiguity on their scope zones must be disambiguated by an appropriate zone ID with the percent character (`%') as @@ -253,9 +253,9 @@ currently only interface names as link identifiers are supported, assuming one-to-one mapping between interfaces and links. For example, a link-local - address fe80::1 on the link - attached to the interface ne0 - can be specified as fe80::1%ne0. + address fe80::1 on the link + attached to the interface ne0 + can be specified as fe80::1%ne0. Note that on most systems link-local addresses always have the ambiguity, and need to be disambiguated. @@ -306,10 +306,10 @@ netmask. Trailing zeros in a ip_addr may omitted. - For example, 127/8 is the - network 127.0.0.0 with - netmask 255.0.0.0 and 1.2.3.0/28 is - network 1.2.3.0 with netmask 255.255.255.240. + For example, 127/8 is the + network 127.0.0.0 with + netmask 255.0.0.0 and 1.2.3.0/28 is + network 1.2.3.0 with netmask 255.255.255.240.

    When specifying a prefix involving a IPv6 scoped address @@ -417,7 +417,7 @@ Integers may take values 0 <= value <= 18446744073709551615, though certain parameters - (such as max-journal-size) may + (such as max-journal-size) may use a more limited range within these extremes. In most cases, setting a value to 0 does not literally mean zero; it means "undefined" or @@ -488,39 +488,39 @@

    -
    +

    Address Match Lists

    -
    +

    -Syntax

    +Syntax
    address_match_list = address_match_list_element ;
   [ address_match_list_element; ... ]
 address_match_list_element = [ ! ] (ip_address [/length] |
    key key_id | acl_name | { address_match_list } )
    -
    +

    -Definition and Usage

    +Definition and Usage

    Address match lists are primarily used to determine access control for various server operations. They are also used in - the listen-on and sortlist + the listen-on and sortlist statements. The elements which constitute an address match list can be any of the following:

    -
      -
    • an IP address (IPv4 or IPv6)
      • -
    • an IP prefix (in `/' notation)
      • -
    • - a key ID, as defined by the key +
        +
      • an IP address (IPv4 or IPv6)
        • +
      • an IP prefix (in `/' notation)
        • +
      • + a key ID, as defined by the key statement
        • -
      • the name of an address match list defined with - the acl statement +
      • the name of an address match list defined with + the acl statement
        • -
      • a nested address match list enclosed in braces
        • +
      • a nested address match list enclosed in braces

      Elements can be negated with a leading exclamation mark (`!'), @@ -544,25 +544,25 @@

      The interpretation of a match depends on whether the list is being - used for access control, defining listen-on ports, or in a - sortlist, and whether the element was negated. + used for access control, defining listen-on ports, or in a + sortlist, and whether the element was negated.

      When used as an access control list, a non-negated match allows access and a negated match denies access. If there is no match, access is denied. The clauses - allow-notify, - allow-recursion, - allow-recursion-on, - allow-query, - allow-query-on, - allow-query-cache, - allow-query-cache-on, - allow-transfer, - allow-update, - allow-update-forwarding, and - blackhole all use address match - lists. Similarly, the listen-on option will cause the + allow-notify, + allow-recursion, + allow-recursion-on, + allow-query, + allow-query-on, + allow-query-cache, + allow-query-cache-on, + allow-transfer, + allow-update, + allow-update-forwarding, and + blackhole all use address match + lists. Similarly, the listen-on option will cause the server to refuse queries on any of the machine's addresses which do not match the list.

      @@ -575,18 +575,18 @@ defines a subset of another element in the list should come before the broader element, regardless of whether either is negated. For example, in - 1.2.3/24; ! 1.2.3.13; + 1.2.3/24; ! 1.2.3.13; the 1.2.3.13 element is completely useless because the algorithm will match any lookup for 1.2.3.13 to the 1.2.3/24 - element. Using ! 1.2.3.13; 1.2.3/24 fixes + element. Using ! 1.2.3.13; 1.2.3/24 fixes that problem by having 1.2.3.13 blocked by the negation, but all other 1.2.3.* hosts fall through.

    -
    +

    -Comment Syntax

    +Comment Syntax

    The BIND 9 comment syntax allows for comments to appear @@ -594,9 +594,9 @@ file. To appeal to programmers of all kinds, they can be written in the C, C++, or shell/perl style.

    -
    +

    -Syntax

    +Syntax

    /* This is a BIND comment as in C */
    @@ -610,9 +610,9 @@

    -
    +

    -Definition and Usage

    +Definition and Usage

    Comments may appear anywhere that whitespace may appear in a BIND configuration file. @@ -684,7 +684,7 @@

    -
    +

    Configuration File Grammar

    @@ -700,13 +700,13 @@

    --++
    -

    acl

    +

    acl

    @@ -717,18 +717,18 @@

    -

    controls

    +

    controls

    declares control channels to be used - by the rndc utility. + by the rndc utility.

    -

    include

    +

    include

    @@ -738,7 +738,7 @@

    -

    key

    +

    key

    @@ -749,7 +749,7 @@

    -

    logging

    +

    logging

    @@ -760,31 +760,31 @@

    -

    lwres

    +

    lwres

    - configures named to - also act as a light-weight resolver daemon (lwresd). + configures named to + also act as a light-weight resolver daemon (lwresd).

    -

    masters

    +

    masters

    defines a named masters list for inclusion in stub and slave zones' - masters or - also-notify lists. + masters or + also-notify lists.

    -

    options

    +

    options

    @@ -795,7 +795,7 @@

    -

    server

    +

    server

    @@ -806,18 +806,18 @@

    -

    statistics-channels

    +

    statistics-channels

    declares communication channels to get access to - named statistics. + named statistics.

    -

    trusted-keys

    +

    trusted-keys

    @@ -827,7 +827,7 @@

    -

    managed-keys

    +

    managed-keys

    @@ -838,7 +838,7 @@

    -

    view

    +

    view

    @@ -848,7 +848,7 @@

    -

    zone

    +

    zone

    @@ -859,25 +859,25 @@

    - The logging and - options statements may only occur once + The logging and + options statements may only occur once per configuration.

    -
    +

    -acl Statement Grammar

    -
    acl acl-name {
+acl Statement Grammar
    +
    acl acl-name {
     address_match_list
 };
    -
    +

    -acl Statement Definition and +acl Statement Definition and Usage

    - The acl statement assigns a symbolic + The acl statement assigns a symbolic name to an address match list. It gets its name from a primary use of address match lists: Access Control Lists (ACLs).

    @@ -886,13 +886,13 @@

    --++
    -

    any

    +

    any

    @@ -902,7 +902,7 @@

    -

    none

    +

    none

    @@ -912,44 +912,44 @@

    -

    localhost

    +

    localhost

    Matches the IPv4 and IPv6 addresses of all network interfaces on the system. When addresses are - added or removed, the localhost + added or removed, the localhost ACL element is updated to reflect the changes.

    -

    localnets

    +

    localnets

    Matches any host on an IPv4 or IPv6 network for which the system has an interface. When addresses are added or removed, - the localnets + the localnets ACL element is updated to reflect the changes. Some systems do not provide a way to determine the prefix lengths of local IPv6 addresses. - In such a case, localnets + In such a case, localnets only matches the local - IPv6 addresses, just like localhost. + IPv6 addresses, just like localhost.

    -
    +

    -controls Statement Grammar

    -
    controls {
+controls Statement Grammar
    +
    controls {
    [ inet ( ip_addr | * ) [ port ip_port ]
                 allow {  address_match_list  }
                 keys { key_list }; ]
@@ -960,70 +960,70 @@
 };
    -
    +

    -controls Statement Definition and +controls Statement Definition and Usage

    - The controls statement declares control + The controls statement declares control channels to be used by system administrators to control the operation of the name server. These control channels are - used by the rndc utility to send + used by the rndc utility to send commands to and retrieve non-DNS results from a name server.

    - An inet control channel is a TCP socket - listening at the specified ip_port on the - specified ip_addr, which can be an IPv4 or IPv6 - address. An ip_addr of * (asterisk) is + An inet control channel is a TCP socket + listening at the specified ip_port on the + specified ip_addr, which can be an IPv4 or IPv6 + address. An ip_addr of * (asterisk) is interpreted as the IPv4 wildcard address; connections will be accepted on any of the system's IPv4 addresses. To listen on the IPv6 wildcard address, - use an ip_addr of ::. - If you will only use rndc on the local host, + use an ip_addr of ::. + If you will only use rndc on the local host, using the loopback address (127.0.0.1 or ::1) is recommended for maximum security.

    If no port is specified, port 953 is used. The asterisk - "*" cannot be used for ip_port. + "*" cannot be used for ip_port.

    The ability to issue commands over the control channel is - restricted by the allow and - keys clauses. + restricted by the allow and + keys clauses. Connections to the control channel are permitted based on the - address_match_list. This is for simple - IP address based filtering only; any key_id - elements of the address_match_list + address_match_list. This is for simple + IP address based filtering only; any key_id + elements of the address_match_list are ignored.

    - A unix control channel is a UNIX domain + A unix control channel is a UNIX domain socket listening at the specified path in the file system. - Access to the socket is specified by the perm, - owner and group clauses. + Access to the socket is specified by the perm, + owner and group clauses. Note on some platforms (SunOS and Solaris) the permissions - (perm) are applied to the parent directory + (perm) are applied to the parent directory as the permissions on the socket itself are ignored.

    The primary authorization mechanism of the command - channel is the key_list, which - contains a list of key_ids. - Each key_id in the key_list + channel is the key_list, which + contains a list of key_ids. + Each key_id in the key_list is authorized to execute commands over the control channel. - See Remote Name Daemon Control application in the section called “Administrative Tools”) - for information about configuring keys in rndc. + See Remote Name Daemon Control application in the section called “Administrative Tools”) + for information about configuring keys in rndc.

    - If no controls statement is present, - named will set up a default + If no controls statement is present, + named will set up a default control channel listening on the loopback address 127.0.0.1 and its IPv6 counterpart ::1. - In this case, and also when the controls statement - is present but does not have a keys clause, - named will attempt to load the command channel key + In this case, and also when the controls statement + is present but does not have a keys clause, + named will attempt to load the command channel key from the file rndc.key in /etc (or whatever sysconfdir was specified as when BIND was built). @@ -1034,12 +1034,12 @@ The rndc.key feature was created to ease the transition of systems from BIND 8, which did not have digital signatures on its command channel - messages and thus did not have a keys clause. + messages and thus did not have a keys clause. It makes it possible to use an existing BIND 8 configuration file in BIND 9 unchanged, - and still have rndc work the same way - ndc worked in BIND 8, simply by executing the + and still have rndc work the same way + ndc worked in BIND 8, simply by executing the command rndc-confgen -a after BIND 9 is installed.

    @@ -1055,10 +1055,10 @@ those things. The rndc.key file also has its permissions set such that only the owner of the file (the user that - named is running as) can access it. + named is running as) can access it. If you desire greater flexibility in allowing other users to access - rndc commands, then you need to create + rndc commands, then you need to create a rndc.conf file and make it group readable by a group @@ -1066,23 +1066,22 @@

    To disable the command channel, use an empty - controls statement: - controls { };. + controls statement: + controls { };.

    -
    +

    -include Statement Grammar

    -
    include filename;
    +include Statement Grammar
    +
    include filename;
    -
    +

    -include Statement Definition and - Usage

    +include Statement Definition and Usage

    - The include statement inserts the - specified file at the point where the include - statement is encountered. The include + The include statement inserts the + specified file at the point where the include + statement is encountered. The include statement facilitates the administration of configuration files by permitting the reading or writing of some things but not @@ -1090,42 +1089,40 @@ that are readable only by the name server.

    -
    +

    -key Statement Grammar

    -
    key key_id {
+key Statement Grammar
    +
    key key_id {
     algorithm algorithm_id;
     secret secret_string;
 };
    -
    +

    -key Statement Definition and Usage

    +key Statement Definition and Usage

    - The key statement defines a shared - secret key for use with TSIG (see the section called “TSIG”) + The key statement defines a shared + secret key for use with TSIG (see the section called “TSIG”) or the command channel - (see the section called “controls Statement Definition and + (see the section called “controls Statement Definition and Usage”).

    - The key statement can occur at the + The key statement can occur at the top level - of the configuration file or inside a view - statement. Keys defined in top-level key + of the configuration file or inside a view + statement. Keys defined in top-level key statements can be used in all views. Keys intended for use in - a controls statement - (see the section called “controls Statement Definition and + a controls statement + (see the section called “controls Statement Definition and Usage”) must be defined at the top level.

    The key_id, also known as the key name, is a domain name uniquely identifying the key. It can - be used in a server + be used in a server statement to cause requests sent to that server to be signed with this key, or in address match lists to verify that incoming requests have been signed with a key @@ -1146,46 +1143,45 @@ encoded string.

    -
    +

    -logging Statement Grammar

    -
    logging {
-   [ channel channel_name {
-     ( file path_name
-         [ versions ( number | unlimited ) ]
-         [ size size_spec ]
-       | syslog syslog_facility
-       | stderr
-       | null );
-     [ severity (critical | error | warning | notice |
+logging Statement Grammar
    +
    logging {
+   [ channel channel_name {
+     ( file path_name
+         [ versions ( number | unlimited ) ]
+         [ size size_spec ]
+       | syslog syslog_facility
+       | stderr
+       | null );
+     [ severity (critical | error | warning | notice |
                  info | debug [ level ] | dynamic ); ]
-     [ print-category yes or no; ]
-     [ print-severity yes or no; ]
-     [ print-time yes or no; ]
+     [ print-category yes or no; ]
+     [ print-severity yes or no; ]
+     [ print-time yes or no; ]
    }; ]
-   [ category category_name {
+   [ category category_name {
      channel_name ; [ channel_name ; ... ]
    }; ]
    ...
 };
    -
    +

    -logging Statement Definition and - Usage

    +logging Statement Definition and Usage

    - The logging statement configures a + The logging statement configures a wide - variety of logging options for the name server. Its channel phrase + variety of logging options for the name server. Its channel phrase associates output methods, format options and severity levels with - a name that can then be used with the category phrase + a name that can then be used with the category phrase to select how various classes of messages are logged.

    - Only one logging statement is used to + Only one logging statement is used to define - as many channels and categories as are wanted. If there is no logging statement, + as many channels and categories as are wanted. If there is no logging statement, the logging configuration will be: 

    logging {
@@ -1197,16 +1193,16 @@
           In BIND 9, the logging configuration
           is only established when
           the entire configuration file has been parsed.  In BIND 8, it was
-          established as soon as the logging
+          established as soon as the logging
           statement
           was parsed. When the server is starting up, all logging messages
           regarding syntax errors in the configuration file go to the default
           channels, or to standard error if the "-g" option
           was specified.
         
    
-
    
+
    
 
    
-The channel Phrase
    
+The channel Phrase

    All log output goes to one or more channels; you can make as many of them as you want. @@ -1217,18 +1213,18 @@ particular syslog facility, to the standard error stream, or are discarded. It can optionally also limit the message severity level that will be accepted by the channel (the default is - info), and whether to include a - named-generated time stamp, the + info), and whether to include a + named-generated time stamp, the category name and/or severity level (the default is not to include any).

    - The null destination clause + The null destination clause causes all messages sent to the channel to be discarded; in that case, other options for the channel are meaningless.

    - The file destination clause directs + The file destination clause directs the channel to a disk file. It can include limitations both on how large the file is allowed to become, and how many @@ -1236,9 +1232,9 @@ of the file will be saved each time the file is opened.

    - If you use the versions log file + If you use the versions log file option, then - named will retain that many backup + named will retain that many backup versions of the file by renaming them when opening. For example, if you choose to keep three old versions @@ -1248,10 +1244,10 @@ lamers.log.2, lamers.log.0 is renamed to lamers.log.1, and lamers.log is renamed to lamers.log.0. - You can say versions unlimited to + You can say versions unlimited to not limit the number of versions. - If a size option is associated with + If a size option is associated with the log file, then renaming is only done when the file being opened exceeds the indicated size. No backup versions are kept by default; any @@ -1259,14 +1255,14 @@ log file is simply appended.

    - The size option for files is used + The size option for files is used to limit log - growth. If the file ever exceeds the size, then named will - stop writing to the file unless it has a versions option + growth. If the file ever exceeds the size, then named will + stop writing to the file unless it has a versions option associated with it. If backup versions are kept, the files are rolled as described above and a new one begun. If there is no - versions option, no more data will + versions option, no more data will be written to the log until some out-of-band mechanism removes or truncates the log to less than the @@ -1275,8 +1271,8 @@ file.

    - Example usage of the size and - versions options: + Example usage of the size and + versions options: 

    channel an_example_channel {
     file "example.log" versions 3 size 20m;
@@ -1285,53 +1281,53 @@
 };

    - The syslog destination clause + The syslog destination clause directs the channel to the system log. Its argument is a - syslog facility as described in the syslog man - page. Known facilities are kern, user, - mail, daemon, auth, - syslog, lpr, news, - uucp, cron, authpriv, - ftp, local0, local1, - local2, local3, local4, - local5, local6 and - local7, however not all facilities + syslog facility as described in the syslog man + page. Known facilities are kern, user, + mail, daemon, auth, + syslog, lpr, news, + uucp, cron, authpriv, + ftp, local0, local1, + local2, local3, local4, + local5, local6 and + local7, however not all facilities are supported on all operating systems. - How syslog will handle messages + How syslog will handle messages sent to - this facility is described in the syslog.conf man - page. If you have a system which uses a very old version of syslog that - only uses two arguments to the openlog() function, + this facility is described in the syslog.conf man + page. If you have a system which uses a very old version of syslog that + only uses two arguments to the openlog() function, then this clause is silently ignored.

    On Windows machines syslog messages are directed to the EventViewer.

    - The severity clause works like syslog's + The severity clause works like syslog's "priorities", except that they can also be used if you are writing - straight to a file rather than using syslog. + straight to a file rather than using syslog. Messages which are not at least of the severity level given will not be selected for the channel; messages of higher severity levels will be accepted.

    - If you are using syslog, then the syslog.conf priorities + If you are using syslog, then the syslog.conf priorities will also determine what eventually passes through. For example, - defining a channel facility and severity as daemon and debug but - only logging daemon.warning via syslog.conf will - cause messages of severity info and - notice to - be dropped. If the situation were reversed, with named writing - messages of only warning or higher, - then syslogd would + defining a channel facility and severity as daemon and debug but + only logging daemon.warning via syslog.conf will + cause messages of severity info and + notice to + be dropped. If the situation were reversed, with named writing + messages of only warning or higher, + then syslogd would print all messages it received from the channel.

    - The stderr destination clause + The stderr destination clause directs the channel to the server's standard error stream. This is intended for @@ -1344,11 +1340,11 @@ it is in debugging mode. If the server's global debug level is greater than zero, then debugging mode will be active. The global debug - level is set either by starting the named server + level is set either by starting the named server with the -d flag followed by a positive integer, - or by running rndc trace. + or by running rndc trace. The global debug level - can be set to zero, and debugging mode turned off, by running rndc + can be set to zero, and debugging mode turned off, by running rndc notrace. All debugging messages in the server have a debug level, and higher debug levels give more detailed output. Channels that specify a specific debug severity, for example: @@ -1361,26 +1357,26 @@ notrace. All debugging messages in the server have a debug

    will get debugging output of level 3 or less any time the server is in debugging mode, regardless of the global debugging - level. Channels with dynamic + level. Channels with dynamic severity use the server's global debug level to determine what messages to print.

    - If print-time has been turned on, + If print-time has been turned on, then - the date and time will be logged. print-time may - be specified for a syslog channel, + the date and time will be logged. print-time may + be specified for a syslog channel, but is usually - pointless since syslog also logs + pointless since syslog also logs the date and - time. If print-category is + time. If print-category is requested, then the - category of the message will be logged as well. Finally, if print-severity is - on, then the severity level of the message will be logged. The print- options may + category of the message will be logged as well. Finally, if print-severity is + on, then the severity level of the message will be logged. The print- options may be used in any combination, and will always be printed in the following order: time, category, severity. Here is an example where all - three print- options + three print- options are on:

    @@ -1388,9 +1384,9 @@ notrace. All debugging messages in the server have a debug

    There are four predefined channels that are used for - named's default logging as follows. + named's default logging as follows. How they are - used is described in the section called “The category Phrase”. + used is described in the section called “The category Phrase”. 

    channel default_syslog {
     // send to syslog's daemon facility
@@ -1420,7 +1416,7 @@ channel null {
 };

    - The default_debug channel has the + The default_debug channel has the special property that it only produces output when the server's debug level is @@ -1430,9 +1426,9 @@ channel null {

    For security reasons, when the "-u" command line option is used, the named.run file - is created only after named has + is created only after named has changed to the - new UID, and any debug output generated while named is + new UID, and any debug output generated while named is starting up and still running as root is discarded. If you need to capture this output, you must run the server with the "-g" option and redirect standard error to a file. @@ -1444,15 +1440,15 @@ channel null { defined.

    -
    +

    -The category Phrase

    +The category Phrase

    There are many categories, so you can send the logs you want to see wherever you want, without seeing logs you don't want. If you don't specify a list of channels for a category, then log messages - in that category will be sent to the default category + in that category will be sent to the default category instead. If you don't specify a default category, the following "default default" is used:

    @@ -1473,7 +1469,7 @@ category security { default_debug; };

    - To discard all messages in a category, specify the null channel: + To discard all messages in a category, specify the null channel: 

    category xfer-out { null; };
 category notify { null; };
@@ -1485,364 +1481,376 @@ category notify { null; };
           
    
 
    --++
+	  
    client
    
+	
+	  
    
+	    Processing of client requests.
+	  
    
+	
+	  
    cname
    
+	
+	  
    
+	    Logs nameservers that are skipped due to them being
+	    a CNAME rather than A / AAAA records.
+	  
    
+	
+	  
    config
    
+	
+	  
    
+	    Configuration file parsing and processing.
+	  
    
+	
+	  
    database
    
+	
+	  
    
+	    Messages relating to the databases used
+	    internally by the name server to store zone and cache
+	    data.
+	  
    
+	
+	  
    default
    
+	
+	  
    
+	    The default category defines the logging
+	    options for those categories where no specific
+	    configuration has been
+	    defined.
+	  
    
+	
+	  
    delegation-only
    
+	
+	  
    
+	    Delegation only.  Logs queries that have been
+	    forced to NXDOMAIN as the result of a
+	    delegation-only zone or a
+	    delegation-only in a
+	    forward, hint or stub zone declaration.
+	  
    
+	
+	  
    dispatch
    
+	
+	  
    
+	    Dispatching of incoming packets to the
+	    server modules where they are to be processed.
+	  
    
+	
+	  
    dnssec
    
+	
+	  
    
+	    DNSSEC and TSIG protocol processing.
+	  
    
+	
+	  
    edns-disabled
    
+	
+	  
    
+	    Log queries that have been forced to use plain
+	    DNS due to timeouts.  This is often due to
+	    the remote servers not being RFC 1034 compliant
+	    (not always returning FORMERR or similar to
+	    EDNS queries and other extensions to the DNS
+	    when they are not understood).  In other words, this is
+	    targeted at servers that fail to respond to
+	    DNS queries that they don't understand.
+	  
    
+	  
    
+	    Note: the log message can also be due to
+	    packet loss.  Before reporting servers for
+	    non-RFC 1034 compliance they should be re-tested
+	    to determine the nature of the non-compliance.
+	    This testing should prevent or reduce the
+	    number of false-positive reports.
+	  
    
+	  
    
+	    Note: eventually named will have to stop
+	    treating such timeouts as due to RFC 1034 non
+	    compliance and start treating it as plain
+	    packet loss.  Falsely classifying packet
+	    loss as due to RFC 1034 non compliance impacts
+	    on DNSSEC validation which requires EDNS for
+	    the DNSSEC records to be returned.
+	  
    
+	
+	  
    general
    
+	
+	  
    
+	    The catch-all. Many things still aren't
+	    classified into categories, and they all end up here.
+	  
    
+	
+	  
    lame-servers
    
+	
+	  
    
+	    Lame servers.  These are misconfigurations
+	    in remote servers, discovered by BIND 9 when trying to
+	    query those servers during resolution.
+	  
    
+	
+	  
    network
    
+	
+	  
    
+	    Network operations.
+	  
    
+	
+	  
    notify
    
+	
+	  
    
+	    The NOTIFY protocol.
+	  
    
+	
+	  
    queries
    
+	
+	  
    
+	    Specify where queries should be logged to.
+	  
    
+	  
    
+	    At startup, specifying the category queries will also
+	    enable query logging unless querylog option has been
+	    specified.
+	  
    
+
+	  
    
+	    The query log entry reports the client's IP
+	    address and port number, and the query name,
+	    class and type.  Next it reports whether the
+	    Recursion Desired flag was set (+ if set, -
+	    if not set), if the query was signed (S),
+	    EDNS was in use (E), if TCP was used (T), if
+	    DO (DNSSEC Ok) was set (D), or if CD (Checking
+	    Disabled) was set (C).  After this the
+	    destination address the query was sent to is
+	    reported.
+	  
    
+
+	  
    
+	    client 127.0.0.1#62536 (www.example.com): query: www.example.com IN AAAA +SE
+	  
    
+	  
    
+	    client ::1#62537 (www.example.net): query: www.example.net IN AAAA -SE
+	  
    
+	  
    
+	    (The first part of this log message, showing the
+	    client address/port number and query name, is
+	    repeated in all subsequent log messages related
+	    to the same query.)
+	  
    
+	
+	  
    query-errors
    
+	
+
+
+
+	  
    rate-limit
    
+	
+
+	  
    resolver
    
+	
+	  
    
+	    DNS resolution, such as the recursive
+	    lookups performed on behalf of clients by a caching name
+	    server.
+	  
    
+	
+	  
    rpz
    
+	
+	  
    
+	    Information about errors in response policy zone files,
+	    rewritten responses, and at the highest
+	    debug levels, mere rewriting
+	    attempts.
+	  
    
+	
+	  
    security
    
+	
+	  
    
+	    Approval and denial of requests.
+	  
    
+	
+	  
    spill
    
+	
+	  
    
+	    Logs queries that have been terminated, either by dropping
+	    or responding with SERVFAIL, as a result of a fetchlimit
+	    quota being exceeded.
+	  
    
+	
+	  
    unmatched
    
+	
+	  
    
+	    Messages that named was unable to determine the
+	    class of or for which there was no matching view.
+	    A one line summary is also logged to the client category.
+	    This category is best sent to a file or stderr, by
+	    default it is sent to
+	    the null channel.
+	  
    
+	
+	  
    update
    
+	
+	  
    
+	    Dynamic updates.
+	  
    
+	
+	  
    update-security
    
+	
+	  
    
+	    Approval and denial of update requests.
+	  
    
+	
+	  
    xfer-in
    
+	
+	  
    
+	    Zone transfers the server is receiving.
+	  
    
+	
+	  
    xfer-out
    
+	
+	  
    
+	    Zone transfers the server is sending.
+	  
    
+	
    
 




 
 
 
    
 
-                    
    default
    
-                      		
 
-                    
    
-                      The default category defines the logging
-                      options for those categories where no specific
-                      configuration has been
-                      defined.
-                    
    
-                      		
 
    
 
    
 
-                    
    general
    
-                      		
 
-                    
    
-                      The catch-all. Many things still aren't
-                      classified into categories, and they all end up here.
-                    
    
-                      		
 
    
 
    
 
-                    
    database
    
-                      		
 
-                    
    
-                      Messages relating to the databases used
-                      internally by the name server to store zone and cache
-                      data.
-                    
    
-                      		
 
    
 
    
 
-                    
    security
    
-                      		
 
-                    
    
-                      Approval and denial of requests.
-                    
    
-                      		
 
    
 
    
 
-                    
    config
    
-                      		
 
-                    
    
-                      Configuration file parsing and processing.
-                    
    
-                      		
 
    
 
    
 
-                    
    resolver
    
-                      		
 
-                    
    
-                      DNS resolution, such as the recursive
-                      lookups performed on behalf of clients by a caching name
-                      server.
-                    
    
-                      		
 
    
 
    
 
-                    
    xfer-in
    
-                      		
 
-                    
    
-                      Zone transfers the server is receiving.
-                    
    
-                      		
 
    
 
    
 
-                    
    xfer-out
    
-                      		
 
-                    
    
-                      Zone transfers the server is sending.
-                    
    
-                      		
 
    
 
    
 
-                    
    notify
    
-                      		
 
-                    
    
-                      The NOTIFY protocol.
-                    
    
-                      		
 
    
 
    
 
-                    
    client
    
-                      		
 
-                    
    
-                      Processing of client requests.
-                    
    
-                      		
 
    
 
    
 
-                    
    unmatched
    
-                      		
 
-                    
    
-                      Messages that named was unable to determine the
-                      class of or for which there was no matching view.
-                      A one line summary is also logged to the client category.
-                      This category is best sent to a file or stderr, by
-                      default it is sent to
-                      the null channel.
-                    
    
-                      		
 
    
 
    
 
-                    
    network
    
-                      		
 
-                    
    
-                      Network operations.
-                    
    
-                      		
 
    
 
    
 
-                    
    update
    
-                      		
 
-                    
    
-                      Dynamic updates.
-                    
    
-                      		
 
    
 
    
 
-                    
    update-security
    
-                      		
 
-                    
    
-                      Approval and denial of update requests.
-                    
    
-                      		
 
    
 
    
 
-                    
    queries
    
-                      		
+	  
    
+	    Information about queries that resulted in some
+	    failure.
+	  
    
+	
    
 
-                    
    
-                      Specify where queries should be logged to.
-                    
    
-                    
    
-                      At startup, specifying the category queries will also
-                      enable query logging unless querylog option has been
-                      specified.
-                    
    
-
-                    
    
-                      The query log entry reports the client's IP
-                      address and port number, and the query name,
-                      class and type.  Next it reports whether the
-                      Recursion Desired flag was set (+ if set, -
-                      if not set), if the query was signed (S),
-                      EDNS was in use (E), if TCP was used (T), if
-                      DO (DNSSEC Ok) was set (D), or if CD (Checking
-                      Disabled) was set (C).  After this the
-                      destination address the query was sent to is
-                      reported.
-                    
    
-
-                    
    
-                      client 127.0.0.1#62536 (www.example.com): query: www.example.com IN AAAA +SE
-                    
    
-                    
    
-                      client ::1#62537 (www.example.net): query: www.example.net IN AAAA -SE
-                    
    
-                    
    
-                      (The first part of this log message, showing the
-                      client address/port number and query name, is
-                      repeated in all subsequent log messages related
-                      to the same query.)
-                    
    
-                      		
+	  
    
+	    (Only available when BIND 9 is
+	    configured with the --enable-rrl
+	    option at compile time.)
+	  
    
+	  
    
+	    The start, periodic, and final notices of the
+	    rate limiting of a stream of responses are logged at
+	    info severity in this category.
+	    These messages include a hash value of the domain name
+	    of the response and the name itself,
+	    except when there is insufficient memory to record
+	    the name for the final notice
+	    The final notice is normally delayed until about one
+	    minute after rate limit stops.
+	    A lack of memory can hurry the final notice,
+	    in which case it starts with an asterisk (*).
+	    Various internal events are logged at debug 1 level
+	    and higher.
+	  
    
+	  
    
+	    Rate limiting of individual requests
+	    is logged in the query-errors category.
+	  
    
+	    		
 
    
 
    
 
-                    
    query-errors
    
-                      		
 
-                    
    
-                      Information about queries that resulted in some
-                      failure.
-                    
    
-                      		
 
    
 
    
 
-                    
    dispatch
    
-                      		
 
-                    
    
-                      Dispatching of incoming packets to the
-                      server modules where they are to be processed.
-                    
    
-                      		
 
    
 
    
 
-                    
    dnssec
    
-                      		
 
-                    
    
-                      DNSSEC and TSIG protocol processing.
-                    
    
-                      		
 
    
 
    
 
-                    
    lame-servers
    
-                      		
 
-                    
    
-                      Lame servers.  These are misconfigurations
-                      in remote servers, discovered by BIND 9 when trying to
-                      query those servers during resolution.
-                    
    
-                      		
 
    
 
    
 
-                    
    delegation-only
    
-                      		
 
-                    
    
-                      Delegation only.  Logs queries that have been
-                      forced to NXDOMAIN as the result of a
-                      delegation-only zone or a
-                      delegation-only in a
-                      forward, hint or stub zone declaration.
-                    
    
-                      		
 
    
 
    
 
-                    
    edns-disabled
    
-                      		
 
-                    
    
-                      Log queries that have been forced to use plain
-                      DNS due to timeouts.  This is often due to
-                      the remote servers not being RFC 1034 compliant
-                      (not always returning FORMERR or similar to
-                      EDNS queries and other extensions to the DNS
-                      when they are not understood).  In other words, this is
-                      targeted at servers that fail to respond to
-                      DNS queries that they don't understand.
-                    
    
-                    
    
-                      Note: the log message can also be due to
-                      packet loss.  Before reporting servers for
-                      non-RFC 1034 compliance they should be re-tested
-                      to determine the nature of the non-compliance.
-                      This testing should prevent or reduce the
-                      number of false-positive reports.
-                    
    
-                    
    
-                      Note: eventually named will have to stop
-                      treating such timeouts as due to RFC 1034 non
-                      compliance and start treating it as plain
-                      packet loss.  Falsely classifying packet
-                      loss as due to RFC 1034 non compliance impacts
-                      on DNSSEC validation which requires EDNS for
-                      the DNSSEC records to be returned.
-                    
    
-                      		
 
    
 
    
 
-                    
    RPZ
    
-                      		
 
-                    
    
-                      Information about errors in response policy zone files,
-                      rewritten responses, and at the highest
-                      debug levels, mere rewriting
-                      attempts.
-                    
    
-                      		
 
    
 
    
 
-                    
    rate-limit
    
-                      		
 
-                    
    
-                      (Only available when BIND 9 is
-                      configured with the --enable-rrl
-                      option at compile time.)
-                    
    
-                    
    
-                      The start, periodic, and final notices of the
-                      rate limiting of a stream of responses are logged at
-                      info severity in this category.
-                      These messages include a hash value of the domain name
-                      of the response and the name itself,
-                      except when there is insufficient memory to record
-                      the name for the final notice
-                      The final notice is normally delayed until about one
-                      minute after rate limit stops.
-                      A lack of memory can hurry the final notice,
-                      in which case it starts with an asterisk (*).
-                      Various internal events are logged at debug 1 level
-                      and higher.
-                    
    
-                    
    
-                      Rate limiting of individual requests
-                      is logged in the query-errors category.
-                    
    
-                      		
 
    
 
    
 
-                    
    cname
    
-                      		
 
-                    
    
-                      Logs nameservers that are skipped due to them being
-                      a CNAME rather than A / AAAA records.
-                    
    
-
    -
    +

    -The query-errors Category

    +The query-errors Category

    - The query-errors category is + The query-errors category is specifically intended for debugging purposes: To identify why and how specific queries result in responses which indicate an error. Messages of this category are therefore only logged - with debug levels. + with debug levels.

    At the debug levels of 1 or higher, each response with the @@ -1905,8 +1913,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]

    --++ @@ -2061,14 +2069,14 @@ badresp:1,adberr:0,findfail:0,valfail:0]

    -
    +

    -lwres Statement Grammar

    +lwres Statement Grammar

    - This is the grammar of the lwres + This is the grammar of the lwres statement in the named.conf file:

    -
    lwres {
+
    lwres {
     [ listen-on { ip_addr [port ip_port] ;
                 [ ip_addr [port ip_port] ; ... ] }; ]
     [ view view_name; ]
@@ -2077,19 +2085,19 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 };
 
    
 
-
    
+
    
 
    
-lwres Statement Definition and Usage
    
+lwres Statement Definition and Usage
    
 
    
-          The lwres statement configures the
+          The lwres statement configures the
           name
           server to also act as a lightweight resolver server. (See
-          the section called “Running a Resolver Daemon”.)  There may be multiple
-          lwres statements configuring
+          the section called “Running a Resolver Daemon”.)  There may be multiple
+          lwres statements configuring
           lightweight resolver servers with different properties.
         
    
 
    
-          The listen-on statement specifies a
+          The listen-on statement specifies a
           list of
           IPv4 addresses (and ports) that this instance of a lightweight
           resolver daemon
@@ -2100,7 +2108,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
           port 921.
         
    
 
    
-          The view statement binds this
+          The view statement binds this
           instance of a
           lightweight resolver daemon to a view in the DNS namespace, so that
           the
@@ -2111,49 +2119,49 @@ badresp:1,adberr:0,findfail:0,valfail:0]
           used, and if there is no default view, an error is triggered.
         
    
 
    
-          The search statement is equivalent to
+          The search statement is equivalent to
           the
-          search statement in
+          search statement in
           /etc/resolv.conf.  It provides a
           list of domains
           which are appended to relative names in queries.
         
    
 
    
-          The ndots statement is equivalent to
+          The ndots statement is equivalent to
           the
-          ndots statement in
+          ndots statement in
           /etc/resolv.conf.  It indicates the
           minimum
           number of dots in a relative domain name that should result in an
           exact match lookup before search path elements are appended.
         
    
 
-
    
+
    
 
    
-masters Statement Grammar
    
+masters Statement Grammar
    
 
    -masters name [port ip_port] { ( masters_list |
+masters name [port ip_port] { ( masters_list |
       ip_addr [port ip_port] [key key] ) ; [...] };
 
    
 
-
    
+
    
 
    
-masters Statement Definition and
+masters Statement Definition and
           Usage
    
-
    masters
+
    masters
           lists allow for a common set of masters to be easily used by
-          multiple stub and slave zones in their masters
-          or also-notify lists.
+          multiple stub and slave zones in their masters
+          or also-notify lists.
         
    
 
    
-
    
+
    
 
    
-options Statement Grammar
    
+options Statement Grammar
    
 
    
-          This is the grammar of the options
+          This is the grammar of the options
           statement in the named.conf file:
         
    
-
    options {
+
    options {
     [ attach-cache cache_name; ]
     [ version version_string; ]
     [ hostname hostname_string; ]
@@ -2197,6 +2205,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
     [ use-id-pool yes_or_no; ]
     [ maintain-ixfr-base yes_or_no; ]
     [ ixfr-from-differences (yes_or_no | master | slave); ]
+    [ auto-dnssec allow|maintain|off; ]
     [ dnssec-enable yes_or_no; ]
     [ dnssec-validation (yes_or_no | auto); ]
     [ dnssec-lookaside ( auto |
@@ -2268,7 +2277,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
     [ max-clients-per-query number ; ]
     [ fetches-per-server number [(drop | fail)]; ]
     [ fetch-quota-params number fixedpoint fixedpoint fixedpoint ; ]
-    [ fetches-per-zonenumber [(drop | fail)]; ]
+    [ fetches-per-zone number [(drop | fail)]; ]
     [ serial-query-rate number; ]
     [ serial-queries number; ]
     [ tcp-listen-queue number; ]
@@ -2286,9 +2295,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
     [ notify-source (ip4_addr | *) [port ip_port] ; ]
     [ notify-source-v6 (ip6_addr | *) [port ip_port] ; ]
     [ notify-to-soa yes_or_no ; ]
-    [ also-notify { ip_addr
-                    [port ip_port] [key keyname] ;
-                    [ ip_addr [port ip_port] [key keyname] ; ... ] }; ]
+    [ also-notify [port ip_port] { ( masters_list | ip_addr
+                              [port ip_port]
+                              [key key] ) ; [...] }; ]
     [ max-ixfr-log-size number; ]
     [ max-journal-size size_spec; ]
     [ coresize size_spec ; ]
@@ -2305,6 +2314,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
     [ lame-ttl number; ]
     [ max-ncache-ttl number; ]
     [ max-cache-ttl number; ]
+    [ serial-update-method increment|unixtime|date; ]
     [ sig-validity-interval number [number] ; ]
     [ sig-signing-nodes number ; ]
     [ sig-signing-signatures number ; ]
@@ -2330,7 +2340,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
         [ clients { address_match_list }; ]
         [ mapped { address_match_list }; ]
         [ exclude { address_match_list }; ]
-        [ suffix IPv6-address; ]
+        [ suffix IPv6-address; ]
         [ recursive-only yes_or_no; ]
         [ break-dnssec yes_or_no; ]
     }; ];
@@ -2389,21 +2399,21 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 };
 
    
 
-
    
+
    
 
    
-options Statement Definition and
+options Statement Definition and
           Usage
    
 
    
-          The options statement sets up global
+          The options statement sets up global
           options
           to be used by BIND. This statement
           may appear only
-          once in a configuration file. If there is no options
+          once in a configuration file. If there is no options
           statement, an options block with each option set to its default will
           be used.
         
    
-
    
-
    attach-cache
    
+
    
+
    attach-cache
    
 
    
 
    
                   Allows multiple views to share a single cache
@@ -2415,15 +2425,15 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                   improve resolution efficiency by using this option.
                 
    
 
    
-                  The attach-cache option
-                  may also be specified in view
+                  The attach-cache option
+                  may also be specified in view
                   statements, in which case it overrides the
-                  global attach-cache option.
+                  global attach-cache option.
                 
    
 
    
                   The cache_name specifies
                   the cache to be shared.
-                  When the named server configures
+                  When the named server configures
                   views which are supposed to share a cache, it
                   creates a cache with the specified name for the
                   first view of these sharing views.
@@ -2434,7 +2444,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                   One common configuration to share a cache would be to
                   allow all views to share a single cache.
                   This can be done by specifying
-                  the attach-cache as a global
+                  the attach-cache as a global
                   option with an arbitrary name.
                 
    
 
    
@@ -2443,7 +2453,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                   retain their own caches.
                   For example, if there are three views A, B, and C,
                   and only A and B should share a cache, specify the
-                  attach-cache option as a view A (or
+                  attach-cache option as a view A (or
                   B)'s option, referring to the other view name:
                 
    
 
    @@ -2466,14 +2476,14 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                   The current implementation requires the following
                   configurable options be consistent among these
                   views:
-                  check-names,
-                  cleaning-interval,
-                  dnssec-accept-expired,
-                  dnssec-validation,
-                  max-cache-ttl,
-                  max-ncache-ttl,
-                  max-cache-size, and
-                  zero-no-soa-ttl.
+                  check-names,
+                  cleaning-interval,
+                  dnssec-accept-expired,
+                  dnssec-validation,
+                  max-cache-ttl,
+                  max-ncache-ttl,
+                  max-cache-size, and
+                  zero-no-soa-ttl.
                 
    
 
    
                   Note that there may be other parameters that may
@@ -2488,7 +2498,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                   not cause disruption with a shared cache.
                 
    
 
    
-
    directory
    
+
    directory
    
 
    
                 The working directory of the server.
                 Any non-absolute pathnames in the configuration file will be
@@ -2503,7 +2513,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                 was started. The directory specified should be an absolute
                 path.
               
    
-
    key-directory
    
+
    key-directory
    
 
    
                 When performing dynamic update of secure zones, the
                 directory where the public and private DNSSEC key files
@@ -2514,7 +2524,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                 rndc.key or
                 session.key.)
               
    
-
    managed-keys-directory
    
+
    managed-keys-directory
    
 
    
 
    
                 Specifies the directory in which to store the files that
@@ -2522,7 +2532,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                 directory.
               
    
 
    
-                If named is not configured to use views,
+                If named is not configured to use views,
                 then managed keys for the server will be tracked in a single
                 file called managed-keys.bind.
                 Otherwise, managed keys will be tracked in separate files,
@@ -2531,23 +2541,23 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                 .mkeys.
               
    
 
    
-
    named-xfer
    
+
    named-xfer
    
 
    
                 This option is obsolete. It
                 was used in BIND 8 to specify
-                the pathname to the named-xfer
+                the pathname to the named-xfer
                 program.  In BIND 9, no separate
-                named-xfer program is needed;
+                named-xfer program is needed;
                 its functionality is built into the name server.
               
    
-
    tkey-gssapi-keytab
    
+
    tkey-gssapi-keytab
    
 
    
                 The KRB5 keytab file to use for GSS-TSIG updates. If
                 this option is set and tkey-gssapi-credential is not
                 set, then updates will be allowed with any key
                 matching a principal in the specified keytab.
               
    
-
    tkey-gssapi-credential
    
+
    tkey-gssapi-credential
    
 
    
                 The security credential with which the server should
                 authenticate keys requested by the GSS-TSIG protocol.
@@ -2558,128 +2568,128 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                 The location keytab file can be overridden using the
                 tkey-gssapi-keytab option. Normally this principal is
                 of the form "DNS/server.domain".
-                To use GSS-TSIG, tkey-domain must
+                To use GSS-TSIG, tkey-domain must
                 also be set if a specific keytab is not set with
                 tkey-gssapi-keytab.
               
    
-
    tkey-domain
    
+
    tkey-domain
    
 
    
                 The domain appended to the names of all shared keys
-                generated with TKEY.  When a
-                client requests a TKEY exchange,
+                generated with TKEY.  When a
+                client requests a TKEY exchange,
                 it may or may not specify the desired name for the
                 key. If present, the name of the shared key will
                 be client specified part +
                 tkey-domain.  Otherwise, the
                 name of the shared key will be random hex
                 digits + tkey-domain.
-                In most cases, the domainname
+                In most cases, the domainname
                 should be the server's domain name, or an otherwise
                 non-existent subdomain like
                 "_tkey.domainname".  If you are
                 using GSS-TSIG, this variable must be defined, unless
                 you specify a specific keytab using tkey-gssapi-keytab.
               
    
-
    tkey-dhkey
    
+
    tkey-dhkey
    
 
    
                 The Diffie-Hellman key used by the server
                 to generate shared keys with clients using the Diffie-Hellman
                 mode
-                of TKEY. The server must be
+                of TKEY. The server must be
                 able to load the
                 public and private keys from files in the working directory.
                 In
                 most cases, the keyname should be the server's host name.
               
    
-
    cache-file
    
+
    cache-file
    
 
    
                 This is for testing only.  Do not use.
               
    
-
    dump-file
    
+
    dump-file
    
 
    
                 The pathname of the file the server dumps
                 the database to when instructed to do so with
-                rndc dumpdb.
+                rndc dumpdb.
                 If not specified, the default is named_dump.db.
               
    
-
    memstatistics-file
    
+
    memstatistics-file
    
 
    
                 The pathname of the file the server writes memory
                 usage statistics to on exit. If not specified,
                 the default is named.memstats.
               
    
-
    pid-file
    
+
    pid-file
    
 
    
                 The pathname of the file the server writes its process ID
                 in. If not specified, the default is
                 /var/run/named/named.pid.
                 The PID file is used by programs that want to send signals to
                 the running
-                name server. Specifying pid-file none disables the
+                name server. Specifying pid-file none disables the
                 use of a PID file — no file will be written and any
-                existing one will be removed.  Note that none
+                existing one will be removed.  Note that none
                 is a keyword, not a filename, and therefore is not enclosed
                 in
                 double quotes.
               
    
-
    recursing-file
    
+
    recursing-file
    
 
    
                 The pathname of the file the server dumps
                 the queries that are currently recursing when instructed
-                to do so with rndc recursing.
+                to do so with rndc recursing.
                 If not specified, the default is named.recursing.
               
    
-
    statistics-file
    
+
    statistics-file
    
 
    
                 The pathname of the file the server appends statistics
-                to when instructed to do so using rndc stats.
+                to when instructed to do so using rndc stats.
                 If not specified, the default is named.stats in the
                 server's current directory.  The format of the file is
                 described
-                in the section called “The Statistics File”.
+                in the section called “The Statistics File”.
               
    
-
    bindkeys-file
    
+
    bindkeys-file
    
 
    
                 The pathname of a file to override the built-in trusted
-                keys provided by named.
-                See the discussion of dnssec-lookaside
-                and dnssec-validation for details.
+                keys provided by named.
+                See the discussion of dnssec-lookaside
+                and dnssec-validation for details.
                 If not specified, the default is
                 /etc/bind.keys.
               
    
-
    secroots-file
    
+
    secroots-file
    
 
    
                 The pathname of the file the server dumps
                 security roots to when instructed to do so with
-                rndc secroots.
+                rndc secroots.
                 If not specified, the default is
                 named.secroots.
               
    
-
    session-keyfile
    
+
    session-keyfile
    
 
    
                 The pathname of the file into which to write a TSIG
-                session key generated by named for use by
-                nsupdate -l.  If not specified, the
+                session key generated by named for use by
+                nsupdate -l.  If not specified, the
                 default is /var/run/named/session.key.
-                (See the section called “Dynamic Update Policies”, and in
+                (See the section called “Dynamic Update Policies”, and in
                 particular the discussion of the
-                update-policy statement's
+                update-policy statement's
                 local option for more
                 information about this feature.)
               
    
-
    session-keyname
    
+
    session-keyname
    
 
    
                 The key name to use for the TSIG session key.
                 If not specified, the default is "local-ddns".
               
    
-
    session-keyalg
    
+
    session-keyalg
    
 
    
                 The algorithm to use for the TSIG session key.
                 Valid values are hmac-sha1, hmac-sha224, hmac-sha256,
                 hmac-sha384, hmac-sha512 and hmac-md5.  If not
                 specified, the default is hmac-sha256.
               
    
-
    port
    
+
    port
    
 
    
                 The UDP/TCP port number the server uses for
                 receiving and sending DNS protocol traffic.
@@ -2689,7 +2699,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                 communicate with
                 the global DNS.
               
    
-
    random-device
    
+
    random-device
    
 
    
                 The source of entropy to be used by the server.  Entropy is
                 primarily needed
@@ -2703,20 +2713,22 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                 is
                 /dev/random
                 (or equivalent) when present, and none otherwise.  The
-                random-device option takes
+                random-device option takes
                 effect during
                 the initial configuration load at server startup time and
                 is ignored on subsequent reloads.
               
    
-
    preferred-glue
    
+
    preferred-glue
    
 
    
                 If specified, the listed type (A or AAAA) will be emitted
                 before other glue
                 in the additional section of a query response.
-                The default is not to prefer any type (NONE).
+                The default is to prefer A records when responding
+                to queries that arrived via IPv4 and AAAA when
+                responding to queries that arrived via IPv6.
               
    
 
    
-root-delegation-only
+root-delegation-only
 
    
 
    
 
    
@@ -2762,22 +2774,22 @@ options {
 };
 
    
 
-
    disable-algorithms
    
+
    disable-algorithms
    
 
    
                 Disable the specified DNSSEC algorithms at and below the
                 specified name.
-                Multiple disable-algorithms
+                Multiple disable-algorithms
                 statements are allowed.
                 Only the most specific will be applied.
               
    
-
    dnssec-lookaside
    
+
    dnssec-lookaside
    
 
    
 
    
-                When set, dnssec-lookaside provides the
+                When set, dnssec-lookaside provides the
                 validator with an alternate method to validate DNSKEY
                 records at the top of a zone.  When a DNSKEY is at or
                 below a domain specified by the deepest
-                dnssec-lookaside, and the normal DNSSEC
+                dnssec-lookaside, and the normal DNSSEC
                 validation has left the key untrusted, the trust-anchor
                 will be appended to the key name and a DLV record will be
                 looked up to see if it can validate the key.  If the DLV
@@ -2785,61 +2797,61 @@ options {
                 record does) the DNSKEY RRset is deemed to be trusted.
               
    
 
    
-                If dnssec-lookaside is set to
+                If dnssec-lookaside is set to
                 auto, then built-in default
                 values for the DLV domain and trust anchor will be
                 used, along with a built-in key for validation.
               
    
 
    
-                If dnssec-lookaside is set to
+                If dnssec-lookaside is set to
                 no, then dnssec-lookaside
                 is not used.
               
    
 
    
                 The default DLV key is stored in the file
                 bind.keys;
-                named will load that key at
-                startup if dnssec-lookaside is set to
+                named will load that key at
+                startup if dnssec-lookaside is set to
                 auto.  A copy of the file is
                 installed along with BIND 9, and is
                 current as of the release date.  If the DLV key expires, a
                 new copy of bind.keys can be downloaded
-                from https://www.isc.org/solutions/dlv/.
+                from https://www.isc.org/solutions/dlv/.
               
    
 
    
                 (To prevent problems if bind.keys is
                 not found, the current key is also compiled in to
-                named.  Relying on this is not
-                recommended, however, as it requires named
+                named.  Relying on this is not
+                recommended, however, as it requires named
                 to be recompiled with a new key when the DLV key expires.)
               
    
 
    
-                NOTE: named only loads certain specific
+                NOTE: named only loads certain specific
                 keys from bind.keys:  those for the
                 DLV zone and for the DNS root zone.  The file cannot be
                 used to store keys for other zones.
               
    
 
    
-
    dnssec-must-be-secure
    
+
    dnssec-must-be-secure
    
 
    
                 Specify hierarchies which must be or may not be secure
                 (signed and validated).  If yes,
-                then named will only accept answers if
+                then named will only accept answers if
                 they are secure.  If no, then normal
                 DNSSEC validation applies allowing for insecure answers to
                 be accepted.  The specified domain must be under a
-                trusted-keys or
-                managed-keys statement, or
-                dnssec-lookaside must be active.
+                trusted-keys or
+                managed-keys statement, or
+                dnssec-lookaside must be active.
               
    
-
    dns64
    
+
    dns64
    
 
    
 
    
-                This directive instructs named to
+                This directive instructs named to
                 return mapped IPv4 addresses to AAAA queries when
                 there are no AAAA records.  It is intended to be
                 used in conjunction with a NAT64.  Each
-                dns64 defines one DNS64 prefix.
+                dns64 defines one DNS64 prefix.
                 Multiple DNS64 prefixes can be defined.
               
    
 
    
@@ -2850,21 +2862,21 @@ options {
                 Additionally a reverse IP6.ARPA zone will be created for
                 the prefix to provide a mapping from the IP6.ARPA names
                 to the corresponding IN-ADDR.ARPA names using synthesized
-                CNAMEs.  dns64-server and
-                dns64-contact can be used to specify
+                CNAMEs.  dns64-server and
+                dns64-contact can be used to specify
                 the name of the server and contact for the zones. These
                 are settable at the view / options level.  These are
                 not settable on a per-prefix basis.
               
    
 
    
-                Each dns64 supports an optional
-                clients ACL that determines which
+                Each dns64 supports an optional
+                clients ACL that determines which
                 clients are affected by this directive.  If not defined,
                 it defaults to any;.
               
    
 
    
-                Each dns64 supports an optional
-                mapped ACL that selects which
+                Each dns64 supports an optional
+                mapped ACL that selects which
                 IPv4 addresses are to be mapped in the corresponding
                 A RRset.  If not defined it defaults to
                 any;.
@@ -2873,15 +2885,15 @@ options {
                 Normally, DNS64 won't apply to a domain name that
                 owns one or more AAAA records; these records will
                 simply be returned.  The optional
-                exclude ACL allows specification
+                exclude ACL allows specification
                 of a list of IPv6 addresses that will be ignored
                 if they appear in a domain name's AAAA records, and
                 DNS64 will be applied to any A records the domain
-                name owns.  If not defined, exclude
+                name owns.  If not defined, exclude
                 defaults to none.
               
    
 
    
-                A optional suffix can also
+                A optional suffix can also
                 be defined to set the bits trailing the mapped
                 IPv4 address bits.  By default these bits are
                 set to ::.  The bits
@@ -2889,17 +2901,17 @@ options {
                 must be zero.
               
    
 
    
-                If recursive-only is set to
-                yes the DNS64 synthesis will
+                If recursive-only is set to
+                yes the DNS64 synthesis will
                 only happen for recursive queries.  The default
-                is no.
+                is no.
               
    
 
    
-                If break-dnssec is set to
-                yes the DNS64 synthesis will
+                If break-dnssec is set to
+                yes the DNS64 synthesis will
                 happen even if the result, if validated, would
                 cause a DNSSEC validation failure.  If this option
-                is set to no (the default), the DO
+                is set to no (the default), the DO
                 is set on the incoming query, and there are RRSIGs on
                 the applicable records, then synthesis will not happen.
               
    
@@ -2914,46 +2926,83 @@ options {
         };
    -
    dnssec-update-mode
    +
    dnssec-loadkeys-interval
    +

    + When a zone is configured with auto-dnssec + maintain; its key repository must be checked + periodically to see if any new keys have been added + or any existing keys' timing metadata has been updated + (see dnssec-keygen(8) and + dnssec-settime(8)). The + dnssec-loadkeys-interval option + sets the frequency of automatic repository checks, in + minutes. The default is 60 (1 hour), + the minimum is 1 (1 minute), and the + maximum is 1440 (24 hours); any higher + value is silently reduced. +

    +
    dnssec-update-mode

    If this option is set to its default value of maintain in a zone of type master which is DNSSEC-signed and configured to allow dynamic updates (see - the section called “Dynamic Update Policies”), and - if named has access to the + the section called “Dynamic Update Policies”), and + if named has access to the private signing key(s) for the zone, then - named will automatically sign all new + named will automatically sign all new or changed records and maintain signatures for the zone by regenerating RRSIG records whenever they approach their expiration date.

    If the option is changed to no-resign, - then named will sign all new or + then named will sign all new or changed records, but scheduled maintenance of signatures is disabled.

    - With either of these settings, named + With either of these settings, named will reject updates to a DNSSEC-signed zone when the signing keys are inactive or unavailable to - named. (A planned third option, + named. (A planned third option, external, will disable all automatic signing and allow DNSSEC data to be submitted into a zone via dynamic update; this is not yet implemented.)

    -
    zone-statistics
    +
    serial-update-method
    +
    +

    + Zones configured for dynamic DNS may use this + option to set the update method that will be used for + the zone serial number in the SOA record. +

    +

    + With the default setting of + serial-update-method increment;, the + SOA serial number will be incremented by one each time + the zone is updated. +

    +

    + When set to + serial-update-method unixtime;, the + SOA serial number will be set to the number of seconds + since the UNIX epoch, unless the serial number is + already greater than or equal to that value, in which + case it is simply incremented by one. +

    +
    +
    zone-statistics

    If full, the server will collect statistical data on all zones (unless specifically turned off on a per-zone basis by specifying - zone-statistics terse or - zone-statistics none - in the zone statement). + zone-statistics terse or + zone-statistics none + in the zone statement). The default is terse, providing minimal statistics on zones (including name and current serial number, but not query type @@ -2961,15 +3010,15 @@ options {

    These statistics may be accessed via the - statistics-channel or - using rndc stats, which + statistics-channel or + using rndc stats, which will dump them to the file listed - in the statistics-file. See - also the section called “The Statistics File”. + in the statistics-file. See + also the section called “The Statistics File”.

    For backward compatibility with earlier versions - of BIND 9, the zone-statistics + of BIND 9, the zone-statistics option can also accept yes or no, which have the same effect as full and @@ -2977,20 +3026,20 @@ options {

    -
    +

    Boolean Options

    -
    -
    allow-new-zones
    +
    +
    allow-new-zones

    If yes, then zones can be - added at runtime via rndc addzone - or deleted via rndc delzone. + added at runtime via rndc addzone + or deleted via rndc delzone. The default is no.

    -
    auth-nxdomain
    +
    auth-nxdomain

    - If yes, then the AA bit + If yes, then the AA bit is always set on NXDOMAIN responses, even if the server is not actually authoritative. The default is no; @@ -2999,22 +3048,22 @@ options { are using very old DNS software, you may need to set it to yes.

    -
    deallocate-on-exit
    +
    deallocate-on-exit

    This option was used in BIND 8 to enable checking for memory leaks on exit. BIND 9 ignores the option and always performs the checks.

    -
    memstatistics
    +
    memstatistics

    Write memory statistics to the file specified by - memstatistics-file at exit. + memstatistics-file at exit. The default is no unless '-m record' is specified on the command line in which case it is yes.

    -
    dialup
    +
    dialup

    If yes, then the @@ -3026,16 +3075,16 @@ options { according to zone type and concentrates the zone maintenance so that it all - happens in a short interval, once every heartbeat-interval and + happens in a short interval, once every heartbeat-interval and hopefully during the one call. It also suppresses some of the normal zone maintenance traffic. The default is no.

    - The dialup option - may also be specified in the view and - zone statements, - in which case it overrides the global dialup + The dialup option + may also be specified in the view and + zone statements, + in which case it overrides the global dialup option.

    @@ -3048,7 +3097,7 @@ options { to verify the zone while the connection is active. The set of servers to which NOTIFY is sent can be controlled by - notify and also-notify. + notify and also-notify.

    If the @@ -3056,7 +3105,7 @@ options { the regular "zone up to date" (refresh) queries and only perform them when the - heartbeat-interval expires in + heartbeat-interval expires in addition to sending NOTIFY requests.

    @@ -3069,7 +3118,7 @@ options { suppresses the normal refresh queries, refresh which suppresses normal refresh processing and sends refresh queries - when the heartbeat-interval + when the heartbeat-interval expires, and passive which just disables normal refresh @@ -3077,10 +3126,10 @@ options {

    ----++++ @@ -3107,7 +3156,7 @@ options {
    -

    no (default)

    +

    no (default)

    @@ -3127,7 +3176,7 @@ options {

    -

    yes

    +

    yes

    @@ -3147,7 +3196,7 @@ options {

    -

    notify

    +

    notify

    @@ -3167,7 +3216,7 @@ options {

    -

    refresh

    +

    refresh

    @@ -3187,7 +3236,7 @@ options {

    -

    passive

    +

    passive

    @@ -3207,7 +3256,7 @@ options {

    -

    notify-passive

    +

    notify-passive

    @@ -3229,17 +3278,17 @@ options {

    Note that normal NOTIFY processing is not affected by - dialup. + dialup.

    -
    fake-iquery
    +
    fake-iquery

    In BIND 8, this option enabled simulating the obsolete DNS query type IQUERY. BIND 9 never does IQUERY simulation.

    -
    fetch-glue
    +
    fetch-glue

    This option is obsolete. In BIND 8, fetch-glue yes @@ -3250,31 +3299,31 @@ options { idea and BIND 9 never does it.

    -
    flush-zones-on-shutdown
    +
    flush-zones-on-shutdown

    When the nameserver exits due receiving SIGTERM, flush or do not flush any pending zone writes. The default is - flush-zones-on-shutdown no. + flush-zones-on-shutdown no.

    -
    has-old-clients
    +
    has-old-clients

    This option was incorrectly implemented in BIND 8, and is ignored by BIND 9. To achieve the intended effect of - has-old-clients yes, specify - the two separate options auth-nxdomain yes - and rfc2308-type1 no instead. + has-old-clients yes, specify + the two separate options auth-nxdomain yes + and rfc2308-type1 no instead.

    -
    host-statistics
    +
    host-statistics

    In BIND 8, this enables keeping of statistics for every host that the name server interacts with. Not implemented in BIND 9.

    -
    maintain-ixfr-base
    +
    maintain-ixfr-base

    This option is obsolete. It was used in BIND 8 to @@ -3282,9 +3331,9 @@ options { kept for Incremental Zone Transfer. BIND 9 maintains a transaction log whenever possible. If you need to disable outgoing incremental zone - transfers, use provide-ixfr no. + transfers, use provide-ixfr no.

    -
    minimal-responses
    +
    minimal-responses

    If yes, then when generating responses the server will only add records to the authority @@ -3293,7 +3342,7 @@ options { performance of the server. The default is no.

    -
    multiple-cnames
    +
    multiple-cnames

    This option was used in BIND 8 to allow a domain name to have multiple CNAME records in violation of @@ -3301,18 +3350,18 @@ options { always strictly enforces the CNAME rules both in master files and dynamic updates.

    -
    notify
    +
    notify

    If yes (the default), DNS NOTIFY messages are sent when a zone the server is authoritative for - changes, see the section called “Notify”. The messages are + changes, see the section called “Notify”. The messages are sent to the servers listed in the zone's NS records (except the master server identified in the SOA MNAME field), and to any servers listed in the - also-notify option. + also-notify option.

    If master-only, notifies are only @@ -3320,20 +3369,20 @@ options { for master zones. If explicit, notifies are sent only to - servers explicitly listed using also-notify. + servers explicitly listed using also-notify. If no, no notifies are sent.

    - The notify option may also be - specified in the zone + The notify option may also be + specified in the zone statement, - in which case it overrides the options notify statement. + in which case it overrides the options notify statement. It would only be necessary to turn off this option if it caused slaves to crash.

    -
    notify-to-soa
    +
    notify-to-soa

    If yes do not check the nameservers in the NS RRset against the SOA MNAME. Normally a NOTIFY @@ -3344,7 +3393,7 @@ options { want the ultimate master to still send NOTIFY messages to all the nameservers listed in the NS RRset.

    -
    recursion
    +
    recursion

    If yes, and a DNS query requests recursion, then the server will attempt @@ -3355,26 +3404,25 @@ options { return a referral response. The default is yes. - Note that setting recursion no does not prevent + Note that setting recursion no does not prevent clients from getting data from the server's cache; it only prevents new data from being cached as an effect of client queries. Caching may still occur as an effect the server's internal operation, such as NOTIFY address lookups. - See also fetch-glue above.

    -
    request-nsid
    +
    request-nsid

    If yes, then an empty EDNS(0) NSID (Name Server Identifier) option is sent with all queries to authoritative name servers during iterative resolution. If the authoritative server returns an NSID option in its response, then its contents are logged in - the resolver category at level - info. + the resolver category at level + info. The default is no.

    -
    rfc2308-type1
    +
    rfc2308-type1

    Setting this to yes will @@ -3390,55 +3438,52 @@ options {

    -
    use-id-pool
    +
    use-id-pool

    This option is obsolete. BIND 9 always allocates query IDs from a pool.

    -
    use-ixfr
    +
    use-ixfr

    This option is obsolete. If you need to disable IXFR to a particular server or servers, see - the information on the provide-ixfr option - in the section called “server Statement Definition and + the information on the provide-ixfr option + in the section called “server Statement Definition and Usage”. See also - the section called “Incremental Zone Transfers (IXFR)”. + the section called “Incremental Zone Transfers (IXFR)”.

    -
    provide-ixfr
    +
    provide-ixfr

    See the description of - provide-ixfr in - the section called “server Statement Definition and + provide-ixfr in + the section called “server Statement Definition and Usage”.

    -
    request-ixfr
    +
    request-ixfr

    See the description of - request-ixfr in - the section called “server Statement Definition and + request-ixfr in + the section called “server Statement Definition and Usage”.

    -
    treat-cr-as-space
    +
    treat-cr-as-space

    This option was used in BIND 8 to make - the server treat carriage return ("\r") characters the same way + the server treat carriage return ("\r") characters the same way as a space or tab character, to facilitate loading of zone files on a UNIX system that were generated - on an NT or DOS machine. In BIND 9, both UNIX "\n" - and NT/DOS "\r\n" newlines + on an NT or DOS machine. In BIND 9, both UNIX "\n" + and NT/DOS "\r\n" newlines are always accepted, and the option is ignored.

    -additional-from-auth, additional-from-cache +additional-from-auth, additional-from-cache

    @@ -3473,7 +3518,7 @@ options { and the record found is "MX 10 mail.example.net", normally the address records (A and AAAA) for mail.example.net will be provided as well, if known, even though they are not in the example.com zone. - Setting these options to no + Setting these options to no disables this behavior and makes the server only search for additional data in the zone it answers from. @@ -3481,14 +3526,14 @@ options {

    These options are intended for use in authoritative-only servers, or in authoritative-only views. Attempts to set - them to no without also + them to no without also specifying - recursion no will cause the + recursion no will cause the server to ignore the options and log a warning message.

    - Specifying additional-from-cache no actually + Specifying additional-from-cache no actually disables the use of the cache not only for additional data lookups but also when looking up the answer. This is usually the @@ -3508,7 +3553,7 @@ options { upwards referral comes from the cache, the server will not be able to provide upwards - referrals when additional-from-cache no + referrals when additional-from-cache no has been specified. Instead, it will respond to such queries with REFUSED. This should not cause any problems since @@ -3516,7 +3561,7 @@ options { process.

    -
    match-mapped-addresses
    +
    match-mapped-addresses

    If yes, then an @@ -3529,11 +3574,11 @@ options { connections, such as zone transfers, to be accepted on an IPv6 socket using mapped addresses. This caused address match lists designed for IPv4 to fail to match. However, - named now solves this problem + named now solves this problem internally. The use of this option is discouraged.

    -
    filter-aaaa-on-v4
    +
    filter-aaaa-on-v4

    This option is only available when @@ -3544,14 +3589,14 @@ options { to DNS clients unless they have connections to the IPv6 Internet. This is not recommended unless absolutely necessary. The default is no. - The filter-aaaa-on-v4 option - may also be specified in view statements - to override the global filter-aaaa-on-v4 + The filter-aaaa-on-v4 option + may also be specified in view statements + to override the global filter-aaaa-on-v4 option.

    If yes, - the DNS client is at an IPv4 address, in filter-aaaa, + the DNS client is at an IPv4 address, in filter-aaaa, and if the response does not include DNSSEC signatures, then all AAAA records are deleted from the response. This filtering applies to all responses and not only @@ -3584,7 +3629,7 @@ options { answer requests for AAAA records received via IPv4.

    -
    ixfr-from-differences
    +
    ixfr-from-differences

    When yes and the server loads a new @@ -3608,40 +3653,80 @@ options { temporarily allocate memory to hold this complete difference set.

    -

    ixfr-from-differences - also accepts master and - slave at the view and options +

    ixfr-from-differences + also accepts master and + slave at the view and options levels which causes - ixfr-from-differences to be enabled for - all master or - slave zones respectively. + ixfr-from-differences to be enabled for + all master or + slave zones respectively. It is off by default.

    -
    multi-master
    +
    multi-master

    This should be set when you have multiple masters for a zone and the - addresses refer to different machines. If yes, named will + addresses refer to different machines. If yes, named will not log - when the serial number on the master is less than what named + when the serial number on the master is less than what named currently has. The default is no.

    -
    dnssec-enable
    +
    auto-dnssec
    +
    +

    + Zones configured for dynamic DNS may use this + option to allow varying levels of automatic DNSSEC key + management. There are three possible settings: +

    +

    + auto-dnssec allow; permits + keys to be updated and the zone fully re-signed + whenever the user issues the command rndc sign + zonename. +

    +

    + auto-dnssec maintain; includes the + above, but also automatically adjusts the zone's DNSSEC + keys on schedule, according to the keys' timing metadata + (see dnssec-keygen(8) and + dnssec-settime(8)). The command + rndc sign + zonename causes + named to load keys from the key + repository and sign the zone with all keys that are + active. + rndc loadkeys + zonename causes + named to load keys from the key + repository and schedule key maintenance events to occur + in the future, but it does not sign the full zone + immediately. Note: once keys have been loaded for a + zone the first time, the repository will be searched + for changes periodically, regardless of whether + rndc loadkeys is used. The recheck + interval is defined by + dnssec-loadkeys-interval.) +

    +

    + The default setting is auto-dnssec off. +

    +
    +
    dnssec-enable

    This indicates whether DNSSEC-related resource - records are to be returned by named. + records are to be returned by named. If set to no, - named will not return DNSSEC-related + named will not return DNSSEC-related resource records unless specifically queried for. The default is yes.

    -
    dnssec-validation
    +
    dnssec-validation

    - Enable DNSSEC validation in named. - Note dnssec-enable also needs to be + Enable DNSSEC validation in named. + Note dnssec-enable also needs to be set to yes to be effective. If set to no, DNSSEC validation is disabled. If set to auto, @@ -3649,8 +3734,8 @@ options { trust-anchor for the DNS root zone is used. If set to yes, DNSSEC validation is enabled, but a trust anchor must be manually configured using - a trusted-keys or - managed-keys statement. The default + a trusted-keys or + managed-keys statement. The default is yes.

    @@ -3659,27 +3744,27 @@ options { Whenever the resolver sends out queries to an EDNS-compliant server, it always sets the DO bit indicating it can support DNSSEC responses even if - dnssec-validation is off. + dnssec-validation is off.

    -
    dnssec-accept-expired
    +
    dnssec-accept-expired

    Accept expired signatures when verifying DNSSEC signatures. The default is no. Setting this option to yes - leaves named vulnerable to + leaves named vulnerable to replay attacks.

    -
    querylog
    +
    querylog

    - Specify whether query logging should be started when named + Specify whether query logging should be started when named starts. - If querylog is not specified, + If querylog is not specified, then the query logging - is determined by the presence of the logging category queries. + is determined by the presence of the logging category queries.

    -
    check-names
    +
    check-names

    This option is used to restrict the character set and syntax @@ -3688,17 +3773,17 @@ options { received from the network. The default varies according to usage area. For - master zones the default is fail. - For slave zones the default - is warn. - For answers received from the network (response) - the default is ignore. + master zones the default is fail. + For slave zones the default + is warn. + For answers received from the network (response) + the default is ignore.

    The rules for legal hostnames and mail domains are derived from RFC 952 and RFC 821 as modified by RFC 1123.

    -

    check-names +

    check-names applies to the owner names of A, AAAA and MX records. It also applies to the domain names in the RDATA of NS, SOA, MX, and SRV records. @@ -3707,32 +3792,32 @@ options { (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).

    -
    check-dup-records
    +
    check-dup-records

    Check master zones for records that are treated as different by DNSSEC but are semantically equal in plain DNS. The - default is to warn. Other possible - values are fail and - ignore. + default is to warn. Other possible + values are fail and + ignore.

    -
    check-mx
    +
    check-mx

    Check whether the MX record appears to refer to a IP address. - The default is to warn. Other possible - values are fail and - ignore. + The default is to warn. Other possible + values are fail and + ignore.

    -
    check-wildcard
    +
    check-wildcard

    This option is used to check for non-terminal wildcards. The use of non-terminal wildcards is almost always as a result of a failure to understand the wildcard matching algorithm (RFC 1034). This option - affects master zones. The default (yes) is to check + affects master zones. The default (yes) is to check for non-terminal wildcards and issue a warning.

    -
    check-integrity
    +
    check-integrity

    Perform post load zone integrity checks on master @@ -3741,11 +3826,11 @@ options { address records exist for delegated zones. For MX and SRV records only in-zone hostnames are checked (for out-of-zone hostnames use - named-checkzone). + named-checkzone). For NS records only names below top of zone are checked (for out-of-zone names and glue consistency - checks use named-checkzone). - The default is yes. + checks use named-checkzone). + The default is yes.

    The use of the SPF record for publishing Sender @@ -3755,48 +3840,48 @@ options { Policy Framework record exists (starts with "v=spf1") if there is an SPF record. Warnings are emitted if the TXT record does not exist and can be suppressed with - check-spf. + check-spf.

    -
    check-mx-cname
    +
    check-mx-cname

    - If check-integrity is set then + If check-integrity is set then fail, warn or ignore MX records that refer - to CNAMES. The default is to warn. + to CNAMES. The default is to warn.

    -
    check-srv-cname
    +
    check-srv-cname

    - If check-integrity is set then + If check-integrity is set then fail, warn or ignore SRV records that refer - to CNAMES. The default is to warn. + to CNAMES. The default is to warn.

    -
    check-sibling
    +
    check-sibling

    When performing integrity checks, also check that - sibling glue exists. The default is yes. + sibling glue exists. The default is yes.

    -
    check-spf
    +
    check-spf

    - If check-integrity is set then + If check-integrity is set then check that there is a TXT Sender Policy Framework record present (starts with "v=spf1") if there is an SPF record present. The default is - warn. + warn.

    -
    zero-no-soa-ttl
    +
    zero-no-soa-ttl

    When returning authoritative negative responses to SOA queries set the TTL of the SOA record returned in the authority section to zero. - The default is yes. + The default is yes.

    -
    zero-no-soa-ttl-cache
    +
    zero-no-soa-ttl-cache

    When caching a negative response to a SOA query set the TTL to zero. - The default is no. + The default is no.

    -
    update-check-ksk
    +
    update-check-ksk

    When set to the default value of yes, @@ -3811,7 +3896,7 @@ options { However, if this option is set to no, then the KSK bit is ignored; KSKs are treated as if they were ZSKs and are used to sign the entire zone. This is - similar to the dnssec-signzone -z + similar to the dnssec-signzone -z command line option.

    @@ -3823,52 +3908,37 @@ options { for that algorithm.

    -
    dnssec-dnskey-kskonly
    +
    dnssec-dnskey-kskonly

    - When this option and update-check-ksk + When this option and update-check-ksk are both set to yes, only key-signing keys (that is, keys with the KSK bit set) will be used to sign the DNSKEY RRset at the zone apex. Zone-signing keys (keys without the KSK bit set) will be used to sign the remainder of the zone, but not the DNSKEY RRset. This is similar to the - dnssec-signzone -x command line option. + dnssec-signzone -x command line option.

    - The default is no. If - update-check-ksk is set to + The default is no. If + update-check-ksk is set to no, this option is ignored.

    -
    dnssec-loadkeys-interval
    -

    - When a zone is configured with auto-dnssec - maintain; its key repository must be checked - periodically to see if any new keys have been added - or any existing keys' timing metadata has been updated - (see dnssec-keygen(8) and - dnssec-settime(8)). The - dnssec-loadkeys-interval option - sets the frequency of automatic repository checks, in - minutes. The default is 60 (1 hour), - the minimum is 1 (1 minute), and the - maximum is 1440 (24 hours); any higher - value is silently reduced. -

    -
    try-tcp-refresh
    +
    try-tcp-refresh

    Try to refresh the zone using TCP if UDP queries fail. For BIND 8 compatibility, the default is - yes. + yes.

    -
    dnssec-secure-to-insecure
    +
    dnssec-secure-to-insecure

    Allow a dynamic zone to transition from secure to insecure (i.e., signed to unsigned) by deleting all - of the DNSKEY records. The default is no. - If set to yes, and if the DNSKEY RRset + of the DNSKEY records. The default is no. + If set to yes, and if the DNSKEY RRset at the zone apex is deleted, all RRSIG and NSEC records will be removed from the zone as well.

    @@ -3881,17 +3951,17 @@ options {

    Note that if a zone has been configured with - auto-dnssec maintain and the + auto-dnssec maintain and the private keys remain accessible in the key repository, then the zone will be automatically signed again the - next time named is started. + next time named is started.

    -
    +

    -Forwarding

    +Forwarding

    The forwarding facility can be used to create a large site-wide cache on a few servers, reducing traffic over links to external @@ -3902,8 +3972,8 @@ options { the server is not authoritative and does not have the answer in its cache.

    -
    -
    forward
    +
    +
    forward

    This option is only meaningful if the forwarders list is not empty. A value of first, @@ -3915,7 +3985,7 @@ options { specified, the server will only query the forwarders.

    -
    forwarders
    +
    forwarders

    Specifies the IP addresses to be used for forwarding. The default is the empty list (no @@ -3927,15 +3997,14 @@ options { for the global forwarding options to be overridden in a variety of ways. You can set particular domains to use different forwarders, - or have a different forward only/first behavior, - or not forward at all, see the section called “zone + or have a different forward only/first behavior, + or not forward at all, see the section called “zone Statement Grammar”.

    -
    +

    -Dual-stack Servers

    +Dual-stack Servers

    Dual-stack servers are used as servers of last resort to work around @@ -3943,64 +4012,64 @@ options { or IPv6 on the host machine.

    -
    -
    dual-stack-servers
    +
    +
    dual-stack-servers

    Specifies host names or addresses of machines with access to both IPv4 and IPv6 transports. If a hostname is used, the server must be able to resolve the name using only the transport it has. If the machine is dual - stacked, then the dual-stack-servers have no effect unless + stacked, then the dual-stack-servers have no effect unless access to a transport has been disabled on the command line - (e.g. named -4). + (e.g. named -4).

    -
    +

    Access Control

    Access to the server can be restricted based on the IP address - of the requesting system. See the section called “Address Match Lists” for + of the requesting system. See the section called “Address Match Lists” for details on how to specify IP address lists.

    -
    -
    allow-notify
    +
    +
    allow-notify

    Specifies which hosts are allowed to notify this server, a slave, of zone changes in addition to the zone masters. - allow-notify may also be + allow-notify may also be specified in the - zone statement, in which case + zone statement, in which case it overrides the - options allow-notify + options allow-notify statement. It is only meaningful for a slave zone. If not specified, the default is to process notify messages only from a zone's master.

    -
    allow-query
    +
    allow-query

    Specifies which hosts are allowed to ask ordinary - DNS questions. allow-query may - also be specified in the zone + DNS questions. allow-query may + also be specified in the zone statement, in which case it overrides the - options allow-query statement. + options allow-query statement. If not specified, the default is to allow queries from all hosts.

    Note

    - allow-query-cache is now + allow-query-cache is now used to specify access to the cache.

    -
    allow-query-on
    +
    allow-query-on

    Specifies which local addresses can accept ordinary @@ -4010,16 +4079,16 @@ options { necessarily knowing the internal network's addresses.

    - Note that allow-query-on is only + Note that allow-query-on is only checked for queries that are permitted by - allow-query. A query must be + allow-query. A query must be allowed by both ACLs, or it will be refused.

    - allow-query-on may - also be specified in the zone + allow-query-on may + also be specified in the zone statement, in which case it overrides the - options allow-query-on statement. + options allow-query-on statement.

    If not specified, the default is to allow queries @@ -4028,57 +4097,57 @@ options {

    Note

    - allow-query-cache is + allow-query-cache is used to specify access to the cache.

    -
    allow-query-cache
    +
    allow-query-cache

    Specifies which hosts are allowed to get answers - from the cache. If allow-query-cache - is not set then allow-recursion - is used if set, otherwise allow-query - is used if set unless recursion no; is - set in which case none; is used, - otherwise the default (localnets; - localhost;) is used. + from the cache. If allow-query-cache + is not set then allow-recursion + is used if set, otherwise allow-query + is used if set unless recursion no; is + set in which case none; is used, + otherwise the default (localnets; + localhost;) is used.

    -
    allow-query-cache-on
    +
    allow-query-cache-on

    Specifies which local addresses can give answers from the cache. If not specified, the default is to allow cache queries on any address, - localnets and - localhost. + localnets and + localhost.

    -
    allow-recursion
    +
    allow-recursion

    Specifies which hosts are allowed to make recursive queries through this server. If - allow-recursion is not set - then allow-query-cache is - used if set, otherwise allow-query + allow-recursion is not set + then allow-query-cache is + used if set, otherwise allow-query is used if set, otherwise the default - (localnets; - localhost;) is used. + (localnets; + localhost;) is used.

    -
    allow-recursion-on
    +
    allow-recursion-on

    Specifies which local addresses can accept recursive queries. If not specified, the default is to allow recursive queries on all addresses.

    -
    allow-update
    +
    allow-update

    Specifies which hosts are allowed to submit Dynamic DNS updates for master zones. The default is to deny updates from all hosts. Note that allowing updates based on the requestor's IP address is insecure; see - the section called “Dynamic Update Security” for details. + the section called “Dynamic Update Security” for details.

    -
    allow-update-forwarding
    +
    allow-update-forwarding

    Specifies which hosts are allowed to @@ -4102,11 +4171,11 @@ options { server may expose master servers relying on insecure IP address based - access control to attacks; see the section called “Dynamic Update Security” + access control to attacks; see the section called “Dynamic Update Security” for more details.

    -
    allow-v6-synthesis
    +
    allow-v6-synthesis

    This option was introduced for the smooth transition from AAAA @@ -4116,17 +4185,17 @@ options { this option was also deprecated. It is now ignored with some warning messages.

    -
    allow-transfer
    +
    allow-transfer

    Specifies which hosts are allowed to - receive zone transfers from the server. allow-transfer may - also be specified in the zone + receive zone transfers from the server. allow-transfer may + also be specified in the zone statement, in which - case it overrides the options allow-transfer statement. + case it overrides the options allow-transfer statement. If not specified, the default is to allow transfers to all hosts.

    -
    blackhole
    +
    blackhole

    Specifies a list of addresses that the server will not accept queries from or use to resolve a @@ -4134,25 +4203,25 @@ options { from these addresses will not be responded to. The default is none.

    -
    filter-aaaa
    +
    filter-aaaa

    Specifies a list of addresses to which - filter-aaaa-on-v4 + filter-aaaa-on-v4 is applies. The default is any.

    -
    no-case-compress
    +
    no-case-compress

    Specifies a list of addresses which require responses to use case-insensitive compression. This ACL can be - used when named needs to work with + used when named needs to work with clients that do not comply with the requirement in RFC 1034 to use case-insensitive name comparisons when checking for matching domain names.

    If left undefined, the ACL defaults to - none: case-insensitive compression + none: case-insensitive compression will be used for all clients. If the ACL is defined and matches a client, then case will be ignored when compressing domain names in DNS responses sent to that @@ -4176,7 +4245,7 @@ options { the client matches this ACL.

    - There are circumstances in which named + There are circumstances in which named will not preserve the case of owner names of records: if a zone file defines records of different types with the same name, but the capitalization of the name is @@ -4191,7 +4260,7 @@ options { ACL.

    -
    resolver-query-timeout
    +
    resolver-query-timeout

    The amount of time the resolver will spend attempting to resolve a recursive query before failing. The default @@ -4201,12 +4270,12 @@ options {

    -
    +

    -Interfaces

    +Interfaces

    The interfaces and ports that the server will answer queries - from may be specified using the listen-on option. listen-on takes + from may be specified using the listen-on option. listen-on takes an optional port and an address_match_list of IPv4 addresses. (IPv6 addresses are ignored, with a logged warning.) @@ -4214,7 +4283,7 @@ options { match list. If a port is not specified, port 53 will be used.

    - Multiple listen-on statements are + Multiple listen-on statements are allowed. For example,

    @@ -4227,11 +4296,11 @@ listen-on port 1234 { !1.2.3.4; 1.2/16; }; 1.2 that is not 1.2.3.4.

    - If no listen-on is specified, the + If no listen-on is specified, the server will listen on port 53 on all IPv4 interfaces.

    - The listen-on-v6 option is used to + The listen-on-v6 option is used to specify the interfaces and the ports on which the server will listen for incoming queries sent using IPv6. @@ -4242,7 +4311,7 @@ listen-on port 1234 { !1.2.3.4; 1.2/16; };

    is specified as the address_match_list for the - listen-on-v6 option, + listen-on-v6 option, the server does not bind a separate socket to each IPv6 interface address as it does for IPv4 if the operating system has enough API support for IPv6 (specifically if it conforms to RFC 3493 and RFC @@ -4257,11 +4326,11 @@ listen-on port 1234 { !1.2.3.4; 1.2/16; }; the server listens on a separate socket for each specified address, regardless of whether the desired API is supported by the system. - IPv4 addresses specified in listen-on-v6 + IPv4 addresses specified in listen-on-v6 will be ignored, with a logged warning.

    - Multiple listen-on-v6 options can + Multiple listen-on-v6 options can be used. For example,

    @@ -4280,52 +4349,52 @@ listen-on-v6 port 1234 { !2001:db8::/32; any; }; 
    listen-on-v6 { none; };

    - If no listen-on-v6 option is + If no listen-on-v6 option is specified, the server will not listen on any IPv6 address - unless -6 is specified when named is - invoked. If -6 is specified then - named will listen on port 53 on all IPv6 interfaces by default. + unless -6 is specified when named is + invoked. If -6 is specified then + named will listen on port 53 on all IPv6 interfaces by default.

    -
    +

    Query Address

    If the server doesn't know the answer to a question, it will - query other name servers. query-source specifies + query other name servers. query-source specifies the address and port used for such queries. For queries sent over - IPv6, there is a separate query-source-v6 option. - If address is * (asterisk) or is omitted, - a wildcard IP address (INADDR_ANY) + IPv6, there is a separate query-source-v6 option. + If address is * (asterisk) or is omitted, + a wildcard IP address (INADDR_ANY) will be used.

    - If port is * or is omitted, + If port is * or is omitted, a random port number from a pre-configured range is picked up and will be used for each query. The port range(s) is that specified in - the use-v4-udp-ports (for IPv4) - and use-v6-udp-ports (for IPv6) + the use-v4-udp-ports (for IPv4) + and use-v6-udp-ports (for IPv6) options, excluding the ranges specified in - the avoid-v4-udp-ports - and avoid-v6-udp-ports options, respectively. + the avoid-v4-udp-ports + and avoid-v6-udp-ports options, respectively.

    - The defaults of the query-source and - query-source-v6 options + The defaults of the query-source and + query-source-v6 options are: 

    query-source address * port *;
 query-source-v6 address * port *;

    - If use-v4-udp-ports or - use-v6-udp-ports is unspecified, - named will check if the operating + If use-v4-udp-ports or + use-v6-udp-ports is unspecified, + named will check if the operating system provides a programming interface to retrieve the system's default range for ephemeral ports. If such an interface is available, - named will use the corresponding system + named will use the corresponding system default range; otherwise, it will use its own defaults: 

    use-v4-udp-ports { range 1024 65535; };
@@ -4338,20 +4407,20 @@ use-v6-udp-ports { range 1024 65535; };
             (14 bits of entropy).
             Note also that the system's default range when used may be
             too small for this purpose, and that the range may even be
-            changed while named is running; the new
-            range will automatically be applied when named
+            changed while named is running; the new
+            range will automatically be applied when named
             is reloaded.
             It is encouraged to
-            configure use-v4-udp-ports and
-            use-v6-udp-ports explicitly so that the
+            configure use-v4-udp-ports and
+            use-v6-udp-ports explicitly so that the
             ranges are sufficiently large and are reasonably
             independent from the ranges used by other applications.
           
    
 
    
             Note: the operational configuration
-            where named runs may prohibit the use
+            where named runs may prohibit the use
             of some ports.  For example, UNIX systems will not allow
-            named running without a root privilege
+            named running without a root privilege
             to use ports less than 1024.
             If such ports are included in the specified (or detected)
             set of query ports, the corresponding query attempts will
@@ -4360,8 +4429,8 @@ use-v6-udp-ports { range 1024 65535; };
             that can be safely used in the expected operational environment.
           
    
 
    
-            The defaults of the avoid-v4-udp-ports and
-            avoid-v6-udp-ports options
+            The defaults of the avoid-v4-udp-ports and
+            avoid-v6-udp-ports options
             are:
           
    
 
    avoid-v4-udp-ports {};
@@ -4369,26 +4438,26 @@ avoid-v6-udp-ports {};
 
    
 
    
             Note: BIND 9.5.0 introduced
-            the use-queryport-pool
+            the use-queryport-pool
             option to support a pool of such random ports, but this
             option is now obsolete because reusing the same ports in
             the pool may not be sufficiently secure.
             For the same reason, it is generally strongly discouraged to
             specify a particular port for the
-            query-source or
-            query-source-v6 options;
+            query-source or
+            query-source-v6 options;
             it implicitly disables the use of randomized port numbers.
           
    
-
    
-
    use-queryport-pool
    
+
    
+
    use-queryport-pool
    
 
    
                   This option is obsolete.
                 
    
-
    queryport-pool-ports
    
+
    queryport-pool-ports
    
 
    
                   This option is obsolete.
                 
    
-
    queryport-pool-updateinterval
    
+
    queryport-pool-updateinterval
    
 
    
                   This option is obsolete.
                 
    
@@ -4396,7 +4465,7 @@ avoid-v6-udp-ports {};
 
    
 
    Note
    
 
    
-              The address specified in the query-source option
+              The address specified in the query-source option
               is used for both UDP and TCP queries, but the port applies only
               to UDP queries.  TCP queries always use a random
               unprivileged port.
@@ -4412,12 +4481,12 @@ avoid-v6-udp-ports {};
 
    
 
    Note
    
 
    
-              See also transfer-source and
-              notify-source.
+              See also transfer-source and
+              notify-source.
             
    
 
    
 
    
-
    
+
    
 
    
 Zone Transfers
    
 
    
@@ -4426,8 +4495,8 @@ avoid-v6-udp-ports {};
             and set limits on the amount of load that transfers place on the
             system. The following options apply to zone transfers.
           
    
-
    
-
    also-notify
    
+
    
+
    also-notify
    
 
    
 
    
                   Defines a global list of IP addresses of name servers
@@ -4438,58 +4507,58 @@ avoid-v6-udp-ports {};
                   This helps to ensure that copies of the zones will
                   quickly converge on stealth servers.
                   Optionally, a port may be specified with each
-                  also-notify address to send
+                  also-notify address to send
                   the notify messages to a port other than the
                   default of 53.
                   An optional TSIG key can also be specified with each
                   address to cause the notify messages to be signed; this
                   can be useful when sending notifies to multiple views.
                   In place of explicit addresses, one or more named
-                  masters lists can be used.
+                  masters lists can be used.
                 
    
 
    
-                  If an also-notify list
-                  is given in a zone statement,
+                  If an also-notify list
+                  is given in a zone statement,
                   it will override
-                  the options also-notify
-                  statement. When a zone notify
+                  the options also-notify
+                  statement. When a zone notify
                   statement
-                  is set to no, the IP
-                  addresses in the global also-notify list will
+                  is set to no, the IP
+                  addresses in the global also-notify list will
                   not be sent NOTIFY messages for that zone. The default is
                   the empty
                   list (no global notification list).
                 
    
 
    
-
    max-transfer-time-in
    
+
    max-transfer-time-in
    
 
    
                   Inbound zone transfers running longer than
                   this many minutes will be terminated. The default is 120
                   minutes
                   (2 hours).  The maximum value is 28 days (40320 minutes).
                 
    
-
    max-transfer-idle-in
    
+
    max-transfer-idle-in
    
 
    
                   Inbound zone transfers making no progress
                   in this many minutes will be terminated. The default is 60
                   minutes
                   (1 hour).  The maximum value is 28 days (40320 minutes).
                 
    
-
    max-transfer-time-out
    
+
    max-transfer-time-out
    
 
    
                   Outbound zone transfers running longer than
                   this many minutes will be terminated. The default is 120
                   minutes
                   (2 hours).  The maximum value is 28 days (40320 minutes).
                 
    
-
    max-transfer-idle-out
    
+
    max-transfer-idle-out
    
 
    
                   Outbound zone transfers making no progress
                   in this many minutes will be terminated.  The default is 60
                   minutes (1
                   hour).  The maximum value is 28 days (40320 minutes).
                 
    
-
    serial-query-rate
    
+
    serial-query-rate
    
 
    
 
    
                   Slave servers will periodically query master
@@ -4498,7 +4567,7 @@ avoid-v6-udp-ports {};
                   the slave server's network bandwidth.  To limit
                   the amount of bandwidth used, BIND 9 limits the
                   rate at which queries are sent.  The value of the
-                  serial-query-rate option, an
+                  serial-query-rate option, an
                   integer, is the maximum number of queries sent
                   per second.  The default is 20 per second.
                   The lowest possible rate is one per second; when set
@@ -4507,77 +4576,77 @@ avoid-v6-udp-ports {};
 
    
                   In addition to controlling the rate SOA refresh
                   queries are issued at,
-                  serial-query-rate also controls
+                  serial-query-rate also controls
                   the rate at which NOTIFY messages are sent from
                   both master and slave zones.
                 
    
 
    
-
    serial-queries
    
+
    serial-queries
    
 
    
-                  In BIND 8, the serial-queries
+                  In BIND 8, the serial-queries
                   option
                   set the maximum number of concurrent serial number queries
                   allowed to be outstanding at any given time.
                   BIND 9 does not limit the number of outstanding
-                  serial queries and ignores the serial-queries option.
+                  serial queries and ignores the serial-queries option.
                   Instead, it limits the rate at which the queries are sent
-                  as defined using the serial-query-rate option.
+                  as defined using the serial-query-rate option.
                 
    
-
    transfer-format
    
+
    transfer-format
    
 
    
                   Zone transfers can be sent using two different formats,
-                  one-answer and
-                  many-answers.
-                  The transfer-format option is used
+                  one-answer and
+                  many-answers.
+                  The transfer-format option is used
                   on the master server to determine which format it sends.
-                  one-answer uses one DNS message per
+                  one-answer uses one DNS message per
                   resource record transferred.
-                  many-answers packs as many resource
+                  many-answers packs as many resource
                   records as possible into a message.
-                  many-answers is more efficient, but is
+                  many-answers is more efficient, but is
                   only supported by relatively new slave servers,
                   such as BIND 9, BIND
                   8.x and BIND 4.9.5 onwards.
-                  The many-answers format is also supported by
+                  The many-answers format is also supported by
                   recent Microsoft Windows nameservers.
-                  The default is many-answers.
-                  transfer-format may be overridden on a
-                  per-server basis by using the server
+                  The default is many-answers.
+                  transfer-format may be overridden on a
+                  per-server basis by using the server
                   statement.
                 
    
-
    transfers-in
    
+
    transfers-in
    
 
    
                   The maximum number of inbound zone transfers
                   that can be running concurrently. The default value is 10.
-                  Increasing transfers-in may
+                  Increasing transfers-in may
                   speed up the convergence
                   of slave zones, but it also may increase the load on the
                   local system.
                 
    
-
    transfers-out
    
+
    transfers-out
    
 
    
                   The maximum number of outbound zone transfers
                   that can be running concurrently. Zone transfer requests in
                   excess
                   of the limit will be refused. The default value is 10.
                 
    
-
    transfers-per-ns
    
+
    transfers-per-ns
    
 
    
                   The maximum number of inbound zone transfers
                   that can be concurrently transferring from a given remote
                   name server.
                   The default value is 2.
-                  Increasing transfers-per-ns
+                  Increasing transfers-per-ns
                   may
                   speed up the convergence of slave zones, but it also may
                   increase
-                  the load on the remote name server. transfers-per-ns may
-                  be overridden on a per-server basis by using the transfers phrase
-                  of the server statement.
+                  the load on the remote name server. transfers-per-ns may
+                  be overridden on a per-server basis by using the transfers phrase
+                  of the server statement.
                 
    
-
    transfer-source
    
+
    transfer-source
    
 
    
-
    transfer-source
+
    transfer-source
                   determines which local address will be bound to IPv4
                   TCP connections used to fetch zones transferred
                   inbound by the server.  It also determines the
@@ -4587,15 +4656,15 @@ avoid-v6-udp-ports {};
                   controlled value which will usually be the address
                   of the interface "closest to" the remote end. This
                   address must appear in the remote end's
-                  allow-transfer option for the
+                  allow-transfer option for the
                   zone being transferred, if one is specified. This
                   statement sets the
-                  transfer-source for all zones,
+                  transfer-source for all zones,
                   but can be overridden on a per-view or per-zone
                   basis by including a
-                  transfer-source statement within
-                  the view or
-                  zone block in the configuration
+                  transfer-source statement within
+                  the view or
+                  zone block in the configuration
                   file.
                 
    
 
    
@@ -4606,58 +4675,60 @@ avoid-v6-udp-ports {};
                   
    
 
    
 
    
-
    transfer-source-v6
    
+
    transfer-source-v6
    
 
    
-                  The same as transfer-source,
+                  The same as transfer-source,
                   except zone transfers are performed using IPv6.
                 
    
-
    alt-transfer-source
    
+
    alt-transfer-source
    
 
    
 
    
                   An alternate transfer source if the one listed in
-                  transfer-source fails and
-                  use-alt-transfer-source is
+                  transfer-source fails and
+                  use-alt-transfer-source is
                   set.
                 
    
 
    
 
    Note
    
+
    
                   If you do not wish the alternate transfer source
                   to be used, you should set
-                  use-alt-transfer-source
+                  use-alt-transfer-source
                   appropriately and you should not depend upon
                   getting an answer back to the first refresh
                   query.
-                
    
+                
    
+
    
 
-
    alt-transfer-source-v6
    
+
    alt-transfer-source-v6
    
 
    
                   An alternate transfer source if the one listed in
-                  transfer-source-v6 fails and
-                  use-alt-transfer-source is
+                  transfer-source-v6 fails and
+                  use-alt-transfer-source is
                   set.
                 
    
-
    use-alt-transfer-source
    
+
    use-alt-transfer-source
    
 
    
                   Use the alternate transfer sources or not.  If views are
-                  specified this defaults to no
+                  specified this defaults to no
                   otherwise it defaults to
-                  yes (for BIND 8
+                  yes (for BIND 8
                   compatibility).
                 
    
-
    notify-source
    
+
    notify-source
    
 
    
-
    notify-source
+
    notify-source
                   determines which local source address, and
                   optionally UDP port, will be used to send NOTIFY
                   messages.  This address must appear in the slave
-                  server's masters zone clause or
-                  in an allow-notify clause.  This
-                  statement sets the notify-source
+                  server's masters zone clause or
+                  in an allow-notify clause.  This
+                  statement sets the notify-source
                   for all zones, but can be overridden on a per-zone or
                   per-view basis by including a
-                  notify-source statement within
-                  the zone or
-                  view block in the configuration
+                  notify-source statement within
+                  the zone or
+                  view block in the configuration
                   file.
                 
    
 
    
@@ -4668,24 +4739,24 @@ avoid-v6-udp-ports {};
                   
    
 
    
 
    
-
    notify-source-v6
    
+
    notify-source-v6
    
 
    
-                  Like notify-source,
+                  Like notify-source,
                   but applies to notify messages sent to IPv6 addresses.
                 
    
 
    
 
    
-
    
+
    
 
    
-UDP Port Lists
    
+UDP Port Lists
    
 
    
-            use-v4-udp-ports,
-            avoid-v4-udp-ports,
-            use-v6-udp-ports, and
-            avoid-v6-udp-ports
+            use-v4-udp-ports,
+            avoid-v4-udp-ports,
+            use-v6-udp-ports, and
+            avoid-v6-udp-ports
             specify a list of IPv4 and IPv6 UDP ports that will be
             used or not used as source ports for UDP messages.
-            See the section called “Query Address” about how the
+            See the section called “Query Address” about how the
             available ports are determined.
             For example, with the following configuration
           
    
@@ -4695,14 +4766,14 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    UDP ports of IPv6 messages sent - from named will be in one + from named will be in one of the following ranges: 32768 to 39999, 40001 to 49999, and 60001 to 65535.

    - avoid-v4-udp-ports and - avoid-v6-udp-ports can be used - to prevent named from choosing as its random source port a + avoid-v4-udp-ports and + avoid-v6-udp-ports can be used + to prevent named from choosing as its random source port a port that is blocked by your firewall or a port that is used by other applications; if a query went out with a source port blocked by a @@ -4710,28 +4781,28 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; answer would not get by the firewall and the name server would have to query again. Note: the desired range can also be represented only with - use-v4-udp-ports and - use-v6-udp-ports, and the - avoid- options are redundant in that + use-v4-udp-ports and + use-v6-udp-ports, and the + avoid- options are redundant in that sense; they are provided for backward compatibility and to possibly simplify the port specification.

    -
    +

    -Operating System Resource Limits

    +Operating System Resource Limits

    The server's usage of many system resources can be limited. Scaled values are allowed when specifying resource limits. For - example, 1G can be used instead of - 1073741824 to specify a limit of + example, 1G can be used instead of + 1073741824 to specify a limit of one - gigabyte. unlimited requests + gigabyte. unlimited requests unlimited use, or the - maximum available amount. default + maximum available amount. default uses the limit that was in force when the server was started. See the description - of size_spec in the section called “Configuration File Elements”. + of size_spec in the section called “Configuration File Elements”.

    The following options set operating system resource limits for @@ -4741,13 +4812,13 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; the unsupported limit is used.

    -
    -
    coresize
    +
    +
    coresize

    The maximum size of a core dump. The default is default.

    -
    datasize
    +
    datasize

    The maximum amount of data memory the server may use. The default is default. @@ -4760,23 +4831,23 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; to raise an operating system data size limit that is too small by default. If you wish to limit the amount of memory used by the server, use the - max-cache-size and - recursive-clients + max-cache-size and + recursive-clients options instead.

    -
    files
    +
    files

    The maximum number of files the server may have open concurrently. The default is unlimited.

    -
    stacksize
    +
    stacksize

    The maximum amount of stack memory the server may use. The default is default.

    -
    +

    Server Resource Limits

    @@ -4784,18 +4855,18 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; resource consumption that are enforced internally by the server rather than the operating system.

    -
    -
    max-ixfr-log-size
    +
    +
    max-ixfr-log-size

    This option is obsolete; it is accepted and ignored for BIND 8 compatibility. The option - max-journal-size performs a + max-journal-size performs a similar function in BIND 9.

    -
    max-journal-size
    +
    max-journal-size

    Sets a maximum size for each journal file - (see the section called “The journal file”). When the journal file + (see the section called “The journal file”). When the journal file approaches the specified size, some of the oldest transactions in the journal @@ -4805,13 +4876,13 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; means 2 gigabytes. This may also be set on a per-zone basis.

    -
    host-statistics-max
    +
    host-statistics-max

    In BIND 8, specifies the maximum number of host statistics entries to be kept. Not implemented in BIND 9.

    -
    recursive-clients
    +
    recursive-clients

    The maximum number ("hard quota") of simultaneous @@ -4821,7 +4892,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; client uses a fair bit of memory (on the order of 20 kilobytes), the value of the - recursive-clients option may + recursive-clients option may have to be decreased on hosts with limited memory.

    @@ -4842,28 +4913,28 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; recursive-clients.

    -
    tcp-clients
    +
    tcp-clients

    The maximum number of simultaneous client TCP connections that the server will accept. The default is 100.

    -clients-per-query, max-clients-per-query +clients-per-query, max-clients-per-query

    These set the initial value (minimum) and maximum number of recursive simultaneous clients for any given query (<qname,qtype,qclass>) that the server will accept - before dropping additional clients. named will attempt to + before dropping additional clients. named will attempt to self tune this value and changes will be logged. The default values are 10 and 100.

    This value should reflect how many queries come in for a given name in the time it takes to resolve that name. - If the number of queries exceed this value, named will + If the number of queries exceed this value, named will assume that it is dealing with a non-responsive zone and will drop additional queries. If it gets a response after dropping queries, it will raise the estimate. The @@ -4871,18 +4942,18 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; remained unchanged.

    - If clients-per-query is set to zero, + If clients-per-query is set to zero, then there is no limit on the number of clients per query and no queries will be dropped.

    - If max-clients-per-query is set to zero, + If max-clients-per-query is set to zero, then there is no upper bound other than imposed by - recursive-clients. + recursive-clients.

    -fetches-per-zone +fetches-per-zone

    @@ -4916,13 +4987,13 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; drop.

    - If fetches-per-zone is set to zero, + If fetches-per-zone is set to zero, then there is no limit on the number of fetches per query and no queries will be dropped. The default is zero.

    The current list of active fetches can be dumped by - running rndc recursing. The list + running rndc recursing. The list includes the number of active fetches for each domain and the number of queries that have been passed or dropped as a result of the @@ -4935,11 +5006,11 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    (Note: This option is only available when BIND is - built with configure --enable-fetchlimit.) + built with configure --enable-fetchlimit.)

    -fetches-per-server +fetches-per-server

    @@ -4962,32 +5033,32 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; fail.

    - If fetches-per-server is set to zero, + If fetches-per-server is set to zero, then there is no limit on the number of fetches per query and no queries will be dropped. The default is zero.

    - The fetches-per-server quota is + The fetches-per-server quota is dynamically adjusted in response to detected congestion. As queries are sent to a server and are either answered or time out, an exponentially weighted moving average is calculated of the ratio of timeouts to responses. If the current average timeout ratio rises above a "high" - threshold, then fetches-per-server + threshold, then fetches-per-server is reduced for that server. If the timeout ratio drops below a "low" threshold, then - fetches-per-server is increased. - The fetch-quota-params options + fetches-per-server is increased. + The fetch-quota-params options can be used to adjust the parameters for this calculation.

    (Note: This option is only available when BIND is - built with configure --enable-fetchlimit.) + built with configure --enable-fetchlimit.)

    -
    fetch-quota-params
    +
    fetch-quota-params

    Sets the parameters to use for dynamic resizing of @@ -5019,15 +5090,15 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    (Note: This option is only available when BIND is - built with configure --enable-fetchlimit.) + built with configure --enable-fetchlimit.)

    -
    reserved-sockets
    +
    reserved-sockets

    The number of file descriptors reserved for TCP, stdio, etc. This needs to be big enough to cover the number of - interfaces named listens on, tcp-clients as well as + interfaces named listens on, tcp-clients as well as to provide room for outgoing TCP queries and incoming zone transfers. The default is 512. The minimum value is 128 and the @@ -5038,7 +5109,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; This option has little effect on Windows.

    -
    max-cache-size
    +
    max-cache-size

    The maximum amount of memory to use for the server's cache, in bytes. @@ -5060,7 +5131,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; separately to the cache of each view. The default is 0.

    -
    tcp-listen-queue
    +
    tcp-listen-queue

    The listen queue depth. The default and minimum is 10. If the kernel supports the accept filter "dataready" this @@ -5074,35 +5145,35 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    -
    +

    -Periodic Task Intervals

    -
    -
    cleaning-interval
    +Periodic Task Intervals
    +
    +
    cleaning-interval

    This interval is effectively obsolete. Previously, the server would remove expired resource records - from the cache every cleaning-interval minutes. + from the cache every cleaning-interval minutes. BIND 9 now manages cache memory in a more sophisticated manner and does not rely on the periodic cleaning any more. Specifying this option therefore has no effect on the server's behavior.

    -
    heartbeat-interval
    +
    heartbeat-interval

    The server will perform zone maintenance tasks - for all zones marked as dialup whenever this + for all zones marked as dialup whenever this interval expires. The default is 60 minutes. Reasonable values are up to 1 day (1440 minutes). The maximum value is 28 days (40320 minutes). If set to 0, no zone maintenance for these zones will occur.

    -
    interface-interval
    +
    interface-interval

    The server will scan the network interface list - every interface-interval + every interface-interval minutes. The default is 60 minutes. The maximum value is 28 days (40320 minutes). If set to 0, interface scanning will only occur when @@ -5110,15 +5181,15 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; server will begin listening for queries on any newly discovered interfaces (provided they are allowed by the - listen-on configuration), and + listen-on configuration), and will stop listening on interfaces that have gone away.

    -
    statistics-interval
    +
    statistics-interval

    Name server statistics will be logged - every statistics-interval + every statistics-interval minutes. The default is 60. The maximum value is 28 days (40320 minutes). If set to 0, no statistics will be logged. @@ -5133,15 +5204,15 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    -
    +

    Topology

    All other things being equal, when the server chooses a name server to query from a list of name servers, it prefers the one that is - topologically closest to itself. The topology statement - takes an address_match_list and + topologically closest to itself. The topology statement + takes an address_match_list and interprets it in a special way. Each top-level list element is assigned a distance. @@ -5172,21 +5243,21 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    Note

    - The topology option + The topology option is not implemented in BIND 9.

    -
    +

    -The sortlist Statement

    +The sortlist Statement

    The response to a DNS query may consist of multiple resource records (RRs) forming a resource records set (RRset). The name server will normally return the RRs within the RRset in an indeterminate order - (but see the rrset-order - statement in the section called “RRset Ordering”). + (but see the rrset-order + statement in the section called “RRset Ordering”). The client resolver code should rearrange the RRs as appropriate, that is, using any addresses on the local net in preference to other addresses. @@ -5197,18 +5268,18 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; configuring the name servers, not all the clients.

    - The sortlist statement (see below) + The sortlist statement (see below) takes - an address_match_list and + an address_match_list and interprets it even - more specifically than the topology + more specifically than the topology statement - does (the section called “Topology”). - Each top level statement in the sortlist must - itself be an explicit address_match_list with + does (the section called “Topology”). + Each top level statement in the sortlist must + itself be an explicit address_match_list with one or two elements. The first element (which may be an IP address, - an IP prefix, an ACL name or a nested address_match_list) + an IP prefix, an ACL name or a nested address_match_list) of each top level list is checked against the source address of the query until a match is found.

    @@ -5220,8 +5291,8 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; address in the response to move to the beginning of the response. If the statement is a list of two elements, then the second element is - treated the same as the address_match_list in - a topology statement. Each top + treated the same as the address_match_list in + a topology statement. Each top level element is assigned a distance and the address in the response with the minimum @@ -5286,21 +5357,21 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; };
    -
    +

    RRset Ordering

    When multiple records are returned in an answer it may be useful to configure the order of the records placed into the response. - The rrset-order statement permits + The rrset-order statement permits configuration of the ordering of the records in a multiple record response. - See also the sortlist statement, - the section called “The sortlist Statement”. + See also the sortlist statement, + the section called “The sortlist Statement”.

    - An order_spec is defined as + An order_spec is defined as follows:

    @@ -5310,22 +5381,22 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; order ordering

    - If no class is specified, the default is ANY. - If no type is specified, the default is ANY. - If no name is specified, the default is "*" (asterisk). + If no class is specified, the default is ANY. + If no type is specified, the default is ANY. + If no name is specified, the default is "*" (asterisk).

    - The legal values for ordering are: + The legal values for ordering are:

    --++
    -

    fixed

    +

    fixed

    @@ -5336,7 +5407,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    -

    random

    +

    random

    @@ -5346,7 +5417,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    -

    cyclic

    +

    cyclic

    @@ -5377,7 +5448,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; in random order. All other records are returned in cyclic order.

    - If multiple rrset-order statements + If multiple rrset-order statements appear, they are not combined — the last one applies.

    @@ -5387,18 +5458,18 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    Note

    In this release of BIND 9, the - rrset-order statement does not support + rrset-order statement does not support "fixed" ordering by default. Fixed ordering can be enabled at compile time by specifying "--enable-fixed-rrset" on the "configure" command line.

    -
    +

    Tuning

    -
    -
    lame-ttl
    +
    +
    lame-ttl

    Sets the number of seconds to cache a @@ -5415,19 +5486,19 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; lame-ttl is set to less than 30 seconds.

    -
    max-ncache-ttl
    +
    max-ncache-ttl

    To reduce network traffic and increase performance, - the server stores negative answers. max-ncache-ttl is + the server stores negative answers. max-ncache-ttl is used to set a maximum retention time for these answers in the server in seconds. The default - max-ncache-ttl is 10800 seconds (3 hours). - max-ncache-ttl cannot exceed + max-ncache-ttl is 10800 seconds (3 hours). + max-ncache-ttl cannot exceed 7 days and will be silently truncated to 7 days if set to a greater value.

    -
    max-cache-ttl
    +
    max-cache-ttl

    Sets the maximum time for which the server will cache ordinary (positive) answers. The default is @@ -5437,7 +5508,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; RRsets (such as NS and glue AAAA/A records) in the resolution process.

    -
    min-roots
    +
    min-roots

    The minimum number of root servers that @@ -5452,12 +5523,12 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    -
    sig-validity-interval
    +
    sig-validity-interval

    Specifies the number of days into the future when DNSSEC signatures automatically generated as a - result of dynamic updates (the section called “Dynamic Update”) will expire. There + result of dynamic updates (the section called “Dynamic Update”) will expire. There is an optional second field which specifies how long before expiry that the signatures will be regenerated. If not specified, the signatures will @@ -5474,27 +5545,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; for a limited amount of clock skew.

    - The sig-validity-interval + The sig-validity-interval should be, at least, several multiples of the SOA expire interval to allow for reasonable interaction between the various timer and expiry dates.

    -
    sig-signing-nodes
    +
    sig-signing-nodes

    Specify the maximum number of nodes to be examined in each quantum when signing a zone with a new DNSKEY. The default is 100.

    -
    sig-signing-signatures
    +
    sig-signing-signatures

    Specify a threshold number of signatures that will terminate processing a quantum when signing a zone with a new DNSKEY. The default is 10.

    -
    sig-signing-type
    +
    sig-signing-type

    Specify a private RDATA type to be used when generating @@ -5507,23 +5578,23 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    Signing state records are used to internally by - named to track the current state of + named to track the current state of a zone-signing process, i.e., whether it is still active or has been completed. The records can be inspected using the command - rndc signing -list zone. - Once named has finished signing + rndc signing -list zone. + Once named has finished signing a zone with a particular key, the signing state record associated with that key can be removed from the zone by running - rndc signing -clear keyid/algorithm zone. + rndc signing -clear keyid/algorithm zone. To clear all of the completed signing state records for a zone, use - rndc signing -clear all zone. + rndc signing -clear all zone.

    -min-refresh-time, max-refresh-time, min-retry-time, max-retry-time +min-refresh-time, max-refresh-time, min-retry-time, max-retry-time

    @@ -5547,14 +5618,14 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    The following defaults apply. - min-refresh-time 300 seconds, - max-refresh-time 2419200 seconds - (4 weeks), min-retry-time 500 seconds, - and max-retry-time 1209600 seconds + min-refresh-time 300 seconds, + max-refresh-time 2419200 seconds + (4 weeks), min-retry-time 500 seconds, + and max-retry-time 1209600 seconds (2 weeks).

    -
    edns-udp-size
    +
    edns-udp-size

    Sets the advertised EDNS UDP buffer size in bytes @@ -5562,73 +5633,73 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; Valid values are 512 to 4096 (values outside this range will be silently adjusted). The default value is 4096. The usual reason for setting - edns-udp-size to a non-default + edns-udp-size to a non-default value is to get UDP answers to pass through broken firewalls that block fragmented packets and/or block UDP packets that are greater than 512 bytes.

    - named will fallback to using 512 bytes + named will fallback to using 512 bytes if it get a series of timeout at the initial value. 512 bytes is not being offered to encourage sites to fix their firewalls. Small EDNS UDP sizes will result in the excessive use of TCP.

    -
    max-udp-size
    +
    max-udp-size

    Sets the maximum EDNS UDP message size - named will send in bytes. + named will send in bytes. Valid values are 512 to 4096 (values outside this range will be silently adjusted). The default value is 4096. The usual reason for setting - max-udp-size to a non-default + max-udp-size to a non-default value is to get UDP answers to pass through broken firewalls that block fragmented packets and/or block UDP packets that are greater than 512 bytes. This is independent of the advertised receive - buffer (edns-udp-size). + buffer (edns-udp-size).

    Setting this to a low value will encourage additional TCP traffic to the nameserver.

    -
    masterfile-format
    +
    masterfile-format

    Specifies the file format of zone files (see - the section called “Additional File Formats”). + the section called “Additional File Formats”). The default value is text, which is the standard textual representation, except for slave zones, in which the default value is raw. Files in other formats than text are typically expected to be generated by the - named-compilezone tool, or dumped by - named. + named-compilezone tool, or dumped by + named.

    Note that when a zone file in a different format than - text is loaded, named + text is loaded, named may omit some of the checks which would be performed for a file in the text format. In particular, - check-names checks do not apply + check-names checks do not apply for the raw format. This means a zone file in the raw format must be generated with the same check level as that - specified in the named configuration + specified in the named configuration file. This statement sets the - masterfile-format for all zones, + masterfile-format for all zones, but can be overridden on a per-zone or per-view basis - by including a masterfile-format - statement within the zone or - view block in the configuration + by including a masterfile-format + statement within the zone or + view block in the configuration file.

    -max-recursion-depth +max-recursion-depth

    Sets the maximum number of levels of recursion @@ -5641,7 +5712,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; default is 7.

    -max-recursion-queries +max-recursion-queries

    Sets the maximum number of iterative queries that @@ -5652,7 +5723,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; and the DNS root zone are exempt from this limitation. The default is 75.

    -
    notify-delay
    +
    notify-delay

    The delay, in seconds, between sending sets of notify @@ -5660,10 +5731,10 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    The overall rate that NOTIFY messages are sent for all - zones is controlled by serial-query-rate. + zones is controlled by serial-query-rate.

    -
    max-rsa-exponent-size
    +
    max-rsa-exponent-size

    The maximum RSA exponent size, in bits, that will be accepted when validating. Valid values are 35 @@ -5672,73 +5743,73 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    -
    +

    Built-in server information zones

    The server provides some helpful diagnostic information through a number of built-in zones under the pseudo-top-level-domain bind in the - CHAOS class. These zones are part + CHAOS class. These zones are part of a - built-in view (see the section called “view Statement Grammar”) of + built-in view (see the section called “view Statement Grammar”) of class - CHAOS which is separate from the - default view of class IN. Most global - configuration options (allow-query, + CHAOS which is separate from the + default view of class IN. Most global + configuration options (allow-query, etc) will apply to this view, but some are locally - overridden: notify, - recursion and - allow-new-zones are + overridden: notify, + recursion and + allow-new-zones are always set to no.

    If you need to disable these zones, use the options - below, or hide the built-in CHAOS + below, or hide the built-in CHAOS view by - defining an explicit view of class CHAOS + defining an explicit view of class CHAOS that matches all clients.

    -
    -
    version
    +
    +
    version

    The version the server should report via a query of the name version.bind - with type TXT, class CHAOS. + with type TXT, class CHAOS. The default is the real version number of this server. - Specifying version none + Specifying version none disables processing of the queries.

    -
    hostname
    +
    hostname

    The hostname the server should report via a query of the name hostname.bind - with type TXT, class CHAOS. + with type TXT, class CHAOS. This defaults to the hostname of the machine hosting the name server as found by the gethostname() function. The primary purpose of such queries is to identify which of a group of anycast servers is actually - answering your queries. Specifying hostname none; + answering your queries. Specifying hostname none; disables processing of the queries.

    -
    server-id
    +
    server-id

    The ID the server should report when receiving a Name Server Identifier (NSID) query, or a query of the name ID.SERVER with type - TXT, class CHAOS. + TXT, class CHAOS. The primary purpose of such queries is to identify which of a group of anycast servers is actually - answering your queries. Specifying server-id none; + answering your queries. Specifying server-id none; disables processing of the queries. - Specifying server-id hostname; will cause named to + Specifying server-id hostname; will cause named to use the hostname as found by the gethostname() function. - The default server-id is none. + The default server-id is none.

    -
    +

    Built-in Empty Zones

    @@ -5761,104 +5832,104 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    The current list of empty zones is:

    -
      -
    • 10.IN-ADDR.ARPA
      • -
    • 16.172.IN-ADDR.ARPA
      • -
    • 17.172.IN-ADDR.ARPA
      • -
    • 18.172.IN-ADDR.ARPA
      • -
    • 19.172.IN-ADDR.ARPA
      • -
    • 20.172.IN-ADDR.ARPA
      • -
    • 21.172.IN-ADDR.ARPA
      • -
    • 22.172.IN-ADDR.ARPA
      • -
    • 23.172.IN-ADDR.ARPA
      • -
    • 24.172.IN-ADDR.ARPA
      • -
    • 25.172.IN-ADDR.ARPA
      • -
    • 26.172.IN-ADDR.ARPA
      • -
    • 27.172.IN-ADDR.ARPA
      • -
    • 28.172.IN-ADDR.ARPA
      • -
    • 29.172.IN-ADDR.ARPA
      • -
    • 30.172.IN-ADDR.ARPA
      • -
    • 31.172.IN-ADDR.ARPA
      • -
    • 168.192.IN-ADDR.ARPA
      • -
    • 64.100.IN-ADDR.ARPA
      • -
    • 65.100.IN-ADDR.ARPA
      • -
    • 66.100.IN-ADDR.ARPA
      • -
    • 67.100.IN-ADDR.ARPA
      • -
    • 68.100.IN-ADDR.ARPA
      • -
    • 69.100.IN-ADDR.ARPA
      • -
    • 70.100.IN-ADDR.ARPA
      • -
    • 71.100.IN-ADDR.ARPA
      • -
    • 72.100.IN-ADDR.ARPA
      • -
    • 73.100.IN-ADDR.ARPA
      • -
    • 74.100.IN-ADDR.ARPA
      • -
    • 75.100.IN-ADDR.ARPA
      • -
    • 76.100.IN-ADDR.ARPA
      • -
    • 77.100.IN-ADDR.ARPA
      • -
    • 78.100.IN-ADDR.ARPA
      • -
    • 79.100.IN-ADDR.ARPA
      • -
    • 80.100.IN-ADDR.ARPA
      • -
    • 81.100.IN-ADDR.ARPA
      • -
    • 82.100.IN-ADDR.ARPA
      • -
    • 83.100.IN-ADDR.ARPA
      • -
    • 84.100.IN-ADDR.ARPA
      • -
    • 85.100.IN-ADDR.ARPA
      • -
    • 86.100.IN-ADDR.ARPA
      • -
    • 87.100.IN-ADDR.ARPA
      • -
    • 88.100.IN-ADDR.ARPA
      • -
    • 89.100.IN-ADDR.ARPA
      • -
    • 90.100.IN-ADDR.ARPA
      • -
    • 91.100.IN-ADDR.ARPA
      • -
    • 92.100.IN-ADDR.ARPA
      • -
    • 93.100.IN-ADDR.ARPA
      • -
    • 94.100.IN-ADDR.ARPA
      • -
    • 95.100.IN-ADDR.ARPA
      • -
    • 96.100.IN-ADDR.ARPA
      • -
    • 97.100.IN-ADDR.ARPA
      • -
    • 98.100.IN-ADDR.ARPA
      • -
    • 99.100.IN-ADDR.ARPA
      • -
    • 100.100.IN-ADDR.ARPA
      • -
    • 101.100.IN-ADDR.ARPA
      • -
    • 102.100.IN-ADDR.ARPA
      • -
    • 103.100.IN-ADDR.ARPA
      • -
    • 104.100.IN-ADDR.ARPA
      • -
    • 105.100.IN-ADDR.ARPA
      • -
    • 106.100.IN-ADDR.ARPA
      • -
    • 107.100.IN-ADDR.ARPA
      • -
    • 108.100.IN-ADDR.ARPA
      • -
    • 109.100.IN-ADDR.ARPA
      • -
    • 110.100.IN-ADDR.ARPA
      • -
    • 111.100.IN-ADDR.ARPA
      • -
    • 112.100.IN-ADDR.ARPA
      • -
    • 113.100.IN-ADDR.ARPA
      • -
    • 114.100.IN-ADDR.ARPA
      • -
    • 115.100.IN-ADDR.ARPA
      • -
    • 116.100.IN-ADDR.ARPA
      • -
    • 117.100.IN-ADDR.ARPA
      • -
    • 118.100.IN-ADDR.ARPA
      • -
    • 119.100.IN-ADDR.ARPA
      • -
    • 120.100.IN-ADDR.ARPA
      • -
    • 121.100.IN-ADDR.ARPA
      • -
    • 122.100.IN-ADDR.ARPA
      • -
    • 123.100.IN-ADDR.ARPA
      • -
    • 124.100.IN-ADDR.ARPA
      • -
    • 125.100.IN-ADDR.ARPA
      • -
    • 126.100.IN-ADDR.ARPA
      • -
    • 127.100.IN-ADDR.ARPA
      • -
    • 0.IN-ADDR.ARPA
      • -
    • 127.IN-ADDR.ARPA
      • -
    • 254.169.IN-ADDR.ARPA
      • -
    • 2.0.192.IN-ADDR.ARPA
      • -
    • 100.51.198.IN-ADDR.ARPA
      • -
    • 113.0.203.IN-ADDR.ARPA
      • -
    • 255.255.255.255.IN-ADDR.ARPA
      • -
    • 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
      • -
    • 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
      • -
    • 8.B.D.0.1.0.0.2.IP6.ARPA
      • -
    • D.F.IP6.ARPA
      • -
    • 8.E.F.IP6.ARPA
      • -
    • 9.E.F.IP6.ARPA
      • -
    • A.E.F.IP6.ARPA
      • -
    • B.E.F.IP6.ARPA
      • +
        +
      • 10.IN-ADDR.ARPA
        • +
      • 16.172.IN-ADDR.ARPA
        • +
      • 17.172.IN-ADDR.ARPA
        • +
      • 18.172.IN-ADDR.ARPA
        • +
      • 19.172.IN-ADDR.ARPA
        • +
      • 20.172.IN-ADDR.ARPA
        • +
      • 21.172.IN-ADDR.ARPA
        • +
      • 22.172.IN-ADDR.ARPA
        • +
      • 23.172.IN-ADDR.ARPA
        • +
      • 24.172.IN-ADDR.ARPA
        • +
      • 25.172.IN-ADDR.ARPA
        • +
      • 26.172.IN-ADDR.ARPA
        • +
      • 27.172.IN-ADDR.ARPA
        • +
      • 28.172.IN-ADDR.ARPA
        • +
      • 29.172.IN-ADDR.ARPA
        • +
      • 30.172.IN-ADDR.ARPA
        • +
      • 31.172.IN-ADDR.ARPA
        • +
      • 168.192.IN-ADDR.ARPA
        • +
      • 64.100.IN-ADDR.ARPA
        • +
      • 65.100.IN-ADDR.ARPA
        • +
      • 66.100.IN-ADDR.ARPA
        • +
      • 67.100.IN-ADDR.ARPA
        • +
      • 68.100.IN-ADDR.ARPA
        • +
      • 69.100.IN-ADDR.ARPA
        • +
      • 70.100.IN-ADDR.ARPA
        • +
      • 71.100.IN-ADDR.ARPA
        • +
      • 72.100.IN-ADDR.ARPA
        • +
      • 73.100.IN-ADDR.ARPA
        • +
      • 74.100.IN-ADDR.ARPA
        • +
      • 75.100.IN-ADDR.ARPA
        • +
      • 76.100.IN-ADDR.ARPA
        • +
      • 77.100.IN-ADDR.ARPA
        • +
      • 78.100.IN-ADDR.ARPA
        • +
      • 79.100.IN-ADDR.ARPA
        • +
      • 80.100.IN-ADDR.ARPA
        • +
      • 81.100.IN-ADDR.ARPA
        • +
      • 82.100.IN-ADDR.ARPA
        • +
      • 83.100.IN-ADDR.ARPA
        • +
      • 84.100.IN-ADDR.ARPA
        • +
      • 85.100.IN-ADDR.ARPA
        • +
      • 86.100.IN-ADDR.ARPA
        • +
      • 87.100.IN-ADDR.ARPA
        • +
      • 88.100.IN-ADDR.ARPA
        • +
      • 89.100.IN-ADDR.ARPA
        • +
      • 90.100.IN-ADDR.ARPA
        • +
      • 91.100.IN-ADDR.ARPA
        • +
      • 92.100.IN-ADDR.ARPA
        • +
      • 93.100.IN-ADDR.ARPA
        • +
      • 94.100.IN-ADDR.ARPA
        • +
      • 95.100.IN-ADDR.ARPA
        • +
      • 96.100.IN-ADDR.ARPA
        • +
      • 97.100.IN-ADDR.ARPA
        • +
      • 98.100.IN-ADDR.ARPA
        • +
      • 99.100.IN-ADDR.ARPA
        • +
      • 100.100.IN-ADDR.ARPA
        • +
      • 101.100.IN-ADDR.ARPA
        • +
      • 102.100.IN-ADDR.ARPA
        • +
      • 103.100.IN-ADDR.ARPA
        • +
      • 104.100.IN-ADDR.ARPA
        • +
      • 105.100.IN-ADDR.ARPA
        • +
      • 106.100.IN-ADDR.ARPA
        • +
      • 107.100.IN-ADDR.ARPA
        • +
      • 108.100.IN-ADDR.ARPA
        • +
      • 109.100.IN-ADDR.ARPA
        • +
      • 110.100.IN-ADDR.ARPA
        • +
      • 111.100.IN-ADDR.ARPA
        • +
      • 112.100.IN-ADDR.ARPA
        • +
      • 113.100.IN-ADDR.ARPA
        • +
      • 114.100.IN-ADDR.ARPA
        • +
      • 115.100.IN-ADDR.ARPA
        • +
      • 116.100.IN-ADDR.ARPA
        • +
      • 117.100.IN-ADDR.ARPA
        • +
      • 118.100.IN-ADDR.ARPA
        • +
      • 119.100.IN-ADDR.ARPA
        • +
      • 120.100.IN-ADDR.ARPA
        • +
      • 121.100.IN-ADDR.ARPA
        • +
      • 122.100.IN-ADDR.ARPA
        • +
      • 123.100.IN-ADDR.ARPA
        • +
      • 124.100.IN-ADDR.ARPA
        • +
      • 125.100.IN-ADDR.ARPA
        • +
      • 126.100.IN-ADDR.ARPA
        • +
      • 127.100.IN-ADDR.ARPA
        • +
      • 0.IN-ADDR.ARPA
        • +
      • 127.IN-ADDR.ARPA
        • +
      • 254.169.IN-ADDR.ARPA
        • +
      • 2.0.192.IN-ADDR.ARPA
        • +
      • 100.51.198.IN-ADDR.ARPA
        • +
      • 113.0.203.IN-ADDR.ARPA
        • +
      • 255.255.255.255.IN-ADDR.ARPA
        • +
      • 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
        • +
      • 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
        • +
      • 8.B.D.0.1.0.0.2.IP6.ARPA
        • +
      • D.F.IP6.ARPA
        • +
      • 8.E.F.IP6.ARPA
        • +
      • 9.E.F.IP6.ARPA
        • +
      • A.E.F.IP6.ARPA
        • +
      • B.E.F.IP6.ARPA

      @@ -5885,46 +5956,48 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

      Note

      +

      The real parent servers for these zones should disable all empty zone under the parent zone they serve. For the real root servers, this is all built-in empty zones. This will enable them to return referrals to deeper in the tree. -

      -
      -
      empty-server
      +

      +
      +
      +
      empty-server

      Specify what server name will appear in the returned SOA record for empty zones. If none is specified, then the zone's name will be used.

      -
      empty-contact
      +
      empty-contact

      Specify what contact name will appear in the returned SOA record for empty zones. If none is specified, then "." will be used.

      -
      empty-zones-enable
      +
      empty-zones-enable

      Enable or disable all empty zones. By default, they are enabled.

      -
      disable-empty-zone
      +
      disable-empty-zone

      Disable individual empty zones. By default, none are disabled. This option can be specified multiple times.

    -
    +

    Additional Section Caching

    - The additional section cache, also called acache, + The additional section cache, also called acache, is an internal cache to improve the response performance of BIND 9. When additional section caching is enabled, BIND 9 will cache an internal short-cut to the additional section content for each answer RR. - Note that acache is an internal caching + Note that acache is an internal caching mechanism of BIND 9, and is not related to the DNS caching server function.

    @@ -5939,35 +6012,35 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    In order to obtain the maximum performance improvement from additional section caching, setting - additional-from-cache - to no is recommended, since the current - implementation of acache + additional-from-cache + to no is recommended, since the current + implementation of acache does not short-cut of additional section information from the DNS cache data.

    - One obvious disadvantage of acache is + One obvious disadvantage of acache is that it requires much more memory for the internal cached data. Thus, if the response performance does not matter and memory consumption is much more critical, the - acache mechanism can be - disabled by setting acache-enable to - no. + acache mechanism can be + disabled by setting acache-enable to + no. It is also possible to specify the upper limit of memory consumption - for acache by using max-acache-size. + for acache by using max-acache-size.

    Additional section caching also has a minor effect on the RRset ordering in the additional section. - Without acache, - cyclic order is effective for the additional + Without acache, + cyclic order is effective for the additional section as well as the answer and authority sections. However, additional section caching fixes the ordering when it first caches an RRset for the additional section, and the same ordering will be kept in succeeding responses, regardless of the - setting of rrset-order. + setting of rrset-order. The effect of this should be minor, however, since an RRset in the additional section typically only contains a small number of RRs (and in many cases @@ -5976,23 +6049,23 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    The following is a summary of options related to - acache. + acache.

    -
    -
    acache-enable
    +
    +
    acache-enable

    - If yes, additional section caching is - enabled. The default value is no. + If yes, additional section caching is + enabled. The default value is no.

    -
    acache-cleaning-interval
    +
    acache-cleaning-interval

    The server will remove stale cache entries, based on an LRU based - algorithm, every acache-cleaning-interval minutes. + algorithm, every acache-cleaning-interval minutes. The default is 60 minutes. If set to 0, no periodic cleaning will occur.

    -
    max-acache-size
    +
    max-acache-size

    The maximum amount of memory in bytes to use for the server's acache. When the amount of data in the acache reaches this limit, @@ -6006,9 +6079,9 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    -
    +

    -Content Filtering

    +Content Filtering

    BIND 9 provides the ability to filter out DNS responses from external DNS servers containing @@ -6016,23 +6089,23 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; Specifically, it can reject address (A or AAAA) records if the corresponding IPv4 or IPv6 addresses match the given address_match_list of the - deny-answer-addresses option. + deny-answer-addresses option. It can also reject CNAME or DNAME records if the "alias" name (i.e., the CNAME alias or the substituted query name due to DNAME) matches the given namelist of the - deny-answer-aliases option, where + deny-answer-aliases option, where "match" means the alias name is a subdomain of one of the name_list elements. If the optional namelist is specified - with except-from, records whose query name + with except-from, records whose query name matches the list will be accepted regardless of the filter setting. Likewise, if the alias name is a subdomain of the - corresponding zone, the deny-answer-aliases + corresponding zone, the deny-answer-aliases filter will not apply; for example, even if "example.com" is specified for - deny-answer-aliases, + deny-answer-aliases, 

    www.example.com. CNAME xxx.example.com.

    @@ -6040,7 +6113,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };

    In the address_match_list of the - deny-answer-addresses option, only + deny-answer-addresses option, only ip_addr and ip_prefix are meaningful; @@ -6061,7 +6134,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; to get access to an internal node of your local network that couldn't be externally accessed otherwise. See the paper available at - + http://portal.acm.org/citation.cfm?id=1315245.1315298 for more details about the attacks. @@ -6095,7 +6168,7 @@ deny-answer-aliases { "example.net"; }; 

    www.example.net. A 192.0.2.2

    it will be accepted since the owner name "www.example.net" - matches the except-from element, + matches the except-from element, "example.net".

    @@ -6129,9 +6202,9 @@ deny-answer-aliases { "example.net"; }; spuriously can break such applications.

    -
    +

    -Response Policy Zone (RPZ) Rewriting

    +Response Policy Zone (RPZ) Rewriting

    BIND 9 includes a limited mechanism to modify DNS responses for requests @@ -6142,12 +6215,12 @@ deny-answer-aliases { "example.net"; };

    Response policy zones are named in the - response-policy option for the view or among the + response-policy option for the view or among the global options if there is no response-policy option for the view. RPZs are ordinary DNS zones containing RRsets that can be queried normally if allowed. It is usually best to restrict those queries with something like - allow-query { localhost; };. + allow-query { localhost; };.

    Four policy triggers are encoded in RPZ records, QNAME, IP, NSIP, @@ -6193,8 +6266,8 @@ deny-answer-aliases { "example.net"; }; NSIP triggers are encoded like IP triggers except as subdomains of rpz-nsip. NSDNAME and NSIP triggers are checked only for names with at - least min-ns-dots dots. - The default value of min-ns-dots is 1 to + least min-ns-dots dots. + The default value of min-ns-dots is 1 to exclude top level domains.

    @@ -6202,24 +6275,24 @@ deny-answer-aliases { "example.net"; }; two or more policy records can be triggered by a response. Because DNS responses can be rewritten according to at most one policy record, a single record encoding an action (other than - DISABLED actions) must be chosen. + DISABLED actions) must be chosen. Triggers or the records that encode them are chosen in the following order:

    -
      -
    • Choose the triggered record in the zone that appears +
        +
      • Choose the triggered record in the zone that appears first in the response-policy option.
        • -
      • Prefer QNAME to IP to NSDNAME to NSIP triggers +
      • Prefer QNAME to IP to NSDNAME to NSIP triggers in a single zone.
        • -
      • Among NSDNAME triggers, prefer the +
      • Among NSDNAME triggers, prefer the trigger that matches the smallest name under the DNSSEC ordering.
        • -
      • Among IP or NSIP triggers, prefer the trigger +
      • Among IP or NSIP triggers, prefer the trigger with the longest prefix.
        • -
      • Among triggers with the same prefix length, +
      • Among triggers with the same prefix length, prefer the IP or NSIP trigger that matches the smallest IP address.
        • @@ -6237,15 +6310,15 @@ deny-answer-aliases { "example.net"; }; RPZ record sets are sets of any types of DNS record except DNAME or DNSSEC that encode actions or responses to queries.

        -
          -
        • The NXDOMAIN response is encoded +
            +
          • The NXDOMAIN response is encoded by a CNAME whose target is the root domain (.)
            • -
          • A CNAME whose target is the wildcard top-level - domain (*.) specifies the NODATA action, +
          • A CNAME whose target is the wildcard top-level + domain (*.) specifies the NODATA action, which rewrites the response to NODATA or ANCOUNT=1.
            • -
          • The Local Data action is +
          • The Local Data action is represented by a set ordinary DNS records that are used to answer queries. Queries for record types not the set are answered with NODATA. @@ -6257,8 +6330,8 @@ deny-answer-aliases { "example.net"; }; The purpose for this special form is query logging in the walled garden's authority DNS server.
            • -
          • The PASSTHRU policy is specified - by a CNAME whose target is rpz-passthru. +
          • The PASSTHRU policy is specified + by a CNAME whose target is rpz-passthru. It causes the response to not be rewritten and is most often used to "poke holes" in policies for CIDR blocks. @@ -6270,18 +6343,18 @@ deny-answer-aliases { "example.net"; };

            The actions specified in an RPZ can be overridden with a - policy clause in the - response-policy option. + policy clause in the + response-policy option. An organization using an RPZ provided by another organization might use this mechanism to redirect domains to its own walled garden.

            -
              -
            • -GIVEN says "do not override but +
                +
              • +GIVEN says "do not override but perform the action specified in the zone."
                • -
              • -DISABLED causes policy records to do +
              • +DISABLED causes policy records to do nothing but log what they might have done. The response to the DNS query will be written according to any triggered policy records that are not disabled. @@ -6289,22 +6362,22 @@ deny-answer-aliases { "example.net"; }; because they will often not be logged if a higher precedence trigger is found first.
                • -
              • -PASSTHRU causes all policy records +
              • +PASSTHRU causes all policy records to act as if they were CNAME records with targets the variable part of their owner name. They protect the response from being changed.
                • -
              • -NXDOMAIN causes all RPZ records +
              • +NXDOMAIN causes all RPZ records to specify NXDOMAIN policies.
                • -
              • -NODATA overrides with the +
              • +NODATA overrides with the NODATA policy
                • -
              • -CNAME domain causes all RPZ +
              • +CNAME domain causes all RPZ policy records to act as if they were "cname domain" records.
              @@ -6314,7 +6387,7 @@ deny-answer-aliases { "example.net"; }; By default, the actions encoded in an RPZ are applied only to queries that ask for recursion (RD=1). That default can be changed for a single RPZ or all RPZs in a view - with a recursive-only no clause. + with a recursive-only no clause. This feature is useful for serving the same zone files both inside and outside an RFC 1918 cloud and using RPZ to delete answers that would otherwise contain RFC 1918 values @@ -6326,7 +6399,7 @@ deny-answer-aliases { "example.net"; }; records are available for request name in the original zone (not the response policy zone). This default can be changed for all RPZs in a view with a - break-dnssec yes clause. + break-dnssec yes clause. In that case, RPZ actions are applied regardless of DNSSEC. The name of the clause option reflects the fact that results rewritten by RPZ actions cannot verify. @@ -6335,7 +6408,7 @@ deny-answer-aliases { "example.net"; }; The TTL of a record modified by RPZ policies is set from the TTL of the relevant record in policy zone. It is then limited to a maximum value. - The max-policy-ttl clause changes that + The max-policy-ttl clause changes that maximum from its default of 5.

              @@ -6393,12 +6466,12 @@ ns.domain.com.rpz-nsdname CNAME .

              Responses rewritten by RPZ are counted in the - RPZRewrites statistics. + RPZRewrites statistics.

            -
            +

            -Response Rate Limiting

            +Response Rate Limiting

          This feature is only available when BIND 9 is compiled with the --enable-rrl @@ -6407,8 +6480,8 @@ ns.domain.com.rpz-nsdname CNAME .

          Excessive almost identical UDP responses can be controlled by configuring a - rate-limit clause in an - options or view statement. + rate-limit clause in an + options or view statement. This mechanism keeps authoritative BIND 9 from being used in amplifying reflection denial of service (DoS) attacks. Short truncated (TC=1) responses can be sent to provide @@ -6435,11 +6508,11 @@ ns.domain.com.rpz-nsdname CNAME . while the account is negative. Responses are tracked within a rolling window of time which defaults to 15 seconds, but can be configured with - the window option to any value from + the window option to any value from 1 to 3600 seconds (1 hour). The account cannot become more positive than the per-second limit - or more negative than window + or more negative than window times the per-second limit. When the specified number of credits for a class of responses is set to 0, those responses are not rate limited. @@ -6450,32 +6523,32 @@ ns.domain.com.rpz-nsdname CNAME . All responses to an address block are counted as if to a single client. The prefix lengths of addresses blocks are - specified with ipv4-prefix-length (default 24) - and ipv6-prefix-length (default 56). + specified with ipv4-prefix-length (default 24) + and ipv6-prefix-length (default 56).

          All non-empty responses for a valid domain name (qname) and record type (qtype) are identical and have a limit specified - with responses-per-second + with responses-per-second (default 0 or no limit). All empty (NODATA) responses for a valid domain, regardless of query type, are identical. Responses in the NODATA class are limited by - nodata-per-second - (default responses-per-second). + nodata-per-second + (default responses-per-second). Requests for any and all undefined subdomains of a given valid domain result in NXDOMAIN errors, and are identical regardless of query type. - They are limited by nxdomain-per-second - (default responses-per-second). + They are limited by nxdomain-per-second + (default responses-per-second). This controls some attacks using random names, but can be relaxed or turned off (set to 0) on servers that expect many legitimate NXDOMAIN responses, such as from anti-spam blacklists. Referrals or delegations to the server of a given domain are identical and are limited by - referrals-per-second - (default responses-per-second). + referrals-per-second + (default responses-per-second).

          Responses generated from local wildcards are counted and limited @@ -6489,9 +6562,9 @@ ns.domain.com.rpz-nsdname CNAME . This controls attacks using invalid requests or distant, broken authoritative servers. By default the limit on errors is the same as the - responses-per-second value, + responses-per-second value, but it can be set separately with - errors-per-second. + errors-per-second.

          Many attacks using DNS involve UDP requests with forged source @@ -6501,13 +6574,13 @@ ns.domain.com.rpz-nsdname CNAME . but could let a third party block responses to legitimate requests. There is a mechanism that can answer some legitimate requests from a client whose address is being forged in a flood. - Setting slip to 2 (its default) causes every + Setting slip to 2 (its default) causes every other UDP request to be answered with a small truncated (TC=1) response. The small size and reduced frequency, and so lack of amplification, of "slipped" responses make them unattractive for reflection DoS attacks. - slip must be between 0 and 10. + slip must be between 0 and 10. A value of 0 does not "slip": no truncated responses are sent due to rate limiting, all responses are dropped. @@ -6515,7 +6588,7 @@ ns.domain.com.rpz-nsdname CNAME . values between 2 and 10 cause every n'th response to slip. Some error responses including REFUSED and SERVFAIL cannot be replaced with truncated responses and are instead - leaked at the slip rate. + leaked at the slip rate.

          (NOTE: Dropped responses from an authoritative server may @@ -6526,21 +6599,21 @@ ns.domain.com.rpz-nsdname CNAME . to validate the responses. When this is not an option, operators who are more concerned with response integrity than with flood mitigation may consider setting - slip to 1, causing all rate-limited + slip to 1, causing all rate-limited responses to be truncated rather than dropped. This reduces the effectiveness of rate-limiting against reflection attacks.)

          When the approximate query per second rate exceeds - the qps-scale value, - then the responses-per-second, - errors-per-second, - nxdomains-per-second and - all-per-second values are reduced by the - ratio of the current rate to the qps-scale value. + the qps-scale value, + then the responses-per-second, + errors-per-second, + nxdomains-per-second and + all-per-second values are reduced by the + ratio of the current rate to the qps-scale value. This feature can tighten defenses during attacks. For example, with - qps-scale 250; responses-per-second 20; and + qps-scale 250; responses-per-second 20; and a total query rate of 1000 queries/second for all queries from all DNS clients including via TCP, then the effective responses/second limit changes to @@ -6551,30 +6624,30 @@ ns.domain.com.rpz-nsdname CNAME .

          Communities of DNS clients can be given their own parameters or no rate limiting by putting - rate-limit statements in view - statements instead of the global option + rate-limit statements in view + statements instead of the global option statement. - A rate-limit statement in a view replaces, - rather than supplementing, a rate-limit + A rate-limit statement in a view replaces, + rather than supplementing, a rate-limit statement among the main options. DNS clients within a view can be exempted from rate limits - with the exempt-clients clause. + with the exempt-clients clause.

          UDP responses of all kinds can be limited with the - all-per-second phrase. + all-per-second phrase. This rate limiting is unlike the rate limiting provided by - responses-per-second, - errors-per-second, and - nxdomains-per-second on a DNS server + responses-per-second, + errors-per-second, and + nxdomains-per-second on a DNS server which are often invisible to the victim of a DNS reflection attack. Unless the forged requests of the attack are the same as the legitimate requests of the victim, the victim's requests are not affected. - Responses affected by an all-per-second limit - are always dropped; the slip value has no + Responses affected by an all-per-second limit + are always dropped; the slip value has no effect. - An all-per-second limit should be + An all-per-second limit should be at least 4 times as large as the other limits, because single DNS clients often send bursts of legitimate requests. @@ -6582,11 +6655,11 @@ ns.domain.com.rpz-nsdname CNAME . requests from an SMTP server for NS, PTR, A, and AAAA records as the incoming SMTP/TCP/IP connection is considered. The SMTP server can need additional NS, A, AAAA, MX, TXT, and SPF - records as it considers the STMP Mail From + records as it considers the STMP Mail From command. Web browsers often repeatedly resolve the same names that are repeated in HTML <IMG> tags in a page. - All-per-second is similar to the + All-per-second is similar to the rate limiting offered by firewalls but often inferior. Attacks that justify ignoring the contents of DNS responses are likely to be attacks on the @@ -6598,35 +6671,35 @@ ns.domain.com.rpz-nsdname CNAME .

          The maximum size of the table used to track requests and - rate limit responses is set with max-table-size. + rate limit responses is set with max-table-size. Each entry in the table is between 40 and 80 bytes. The table needs approximately as many entries as the number of requests received per second. The default is 20,000. To reduce the cold start of growing the table, - min-table-size (default 500) + min-table-size (default 500) can set the minimum table size. - Enable rate-limit category logging to monitor + Enable rate-limit category logging to monitor expansions of the table and inform choices for the initial and maximum table size.

          - Use log-only yes to test rate limiting parameters + Use log-only yes to test rate limiting parameters without actually dropping any requests.

          Responses dropped by rate limits are included in the - RateDropped and QryDropped + RateDropped and QryDropped statistics. Responses that truncated by rate limits are included in - RateSlipped and RespTruncated. + RateSlipped and RespTruncated.

      -
      +

      -server Statement Grammar

      -
      server ip_addr[/prefixlen] {
+server Statement Grammar
    +
    server ip_addr[/prefixlen] {
     [ bogus yes_or_no ; ]
     [ provide-ixfr yes_or_no ; ]
     [ request-ixfr yes_or_no ; ]
@@ -6651,12 +6724,12 @@ ns.domain.com.rpz-nsdname   CNAME   .
 };
    -
    +

    -server Statement Definition and +server Statement Definition and Usage

    - The server statement defines + The server statement defines characteristics to be associated with a remote name server. If a prefix length is specified, then a range of servers is covered. Only the most @@ -6665,17 +6738,17 @@ ns.domain.com.rpz-nsdname CNAME . named.conf.

    - The server statement can occur at + The server statement can occur at the top level of the - configuration file or inside a view + configuration file or inside a view statement. - If a view statement contains - one or more server statements, only + If a view statement contains + one or more server statements, only those apply to the view and any top-level ones are ignored. - If a view contains no server + If a view contains no server statements, - any top-level server statements are + any top-level server statements are used as defaults.

    @@ -6683,30 +6756,30 @@ ns.domain.com.rpz-nsdname CNAME . If you discover that a remote server is giving out bad data, marking it as bogus will prevent further queries to it. The default - value of bogus is no. + value of bogus is no.

    - The provide-ixfr clause determines + The provide-ixfr clause determines whether the local server, acting as master, will respond with an incremental zone transfer when the given remote server, a slave, requests it. - If set to yes, incremental transfer + If set to yes, incremental transfer will be provided - whenever possible. If set to no, + whenever possible. If set to no, all transfers to the remote server will be non-incremental. If not set, the value - of the provide-ixfr option in the + of the provide-ixfr option in the view or global options block is used as a default.

    - The request-ixfr clause determines + The request-ixfr clause determines whether the local server, acting as a slave, will request incremental zone transfers from the given remote server, a master. If not set, the - value of the request-ixfr option in + value of the request-ixfr option in the view or global options block is used as a default. It may also be set in the zone block and, if set there, it will override the global or view setting for that zone. @@ -6717,22 +6790,22 @@ ns.domain.com.rpz-nsdname CNAME . fall back to AXFR. Therefore, there is no need to manually list which servers support IXFR and which ones do not; the global default - of yes should always work. - The purpose of the provide-ixfr and - request-ixfr clauses is + of yes should always work. + The purpose of the provide-ixfr and + request-ixfr clauses is to make it possible to disable the use of IXFR even when both master and slave claim to support it, for example if one of the servers is buggy and crashes or corrupts data when IXFR is used.

    - The edns clause determines whether + The edns clause determines whether the local server will attempt to use EDNS when communicating - with the remote server. The default is yes. + with the remote server. The default is yes.

    - The edns-udp-size option sets the EDNS UDP size - that is advertised by named when querying the remote server. + The edns-udp-size option sets the EDNS UDP size + that is advertised by named when querying the remote server. Valid values are 512 to 4096 bytes (values outside this range will be silently adjusted). This option is useful when you wish to advertises a different value to this server than the value you @@ -6740,38 +6813,38 @@ ns.domain.com.rpz-nsdname CNAME . remote site that is blocking large replies.

    - The max-udp-size option sets the - maximum EDNS UDP message size named will send. Valid + The max-udp-size option sets the + maximum EDNS UDP message size named will send. Valid values are 512 to 4096 bytes (values outside this range will be silently adjusted). This option is useful when you know that there is a firewall that is blocking large - replies from named. + replies from named.

    - The server supports two zone transfer methods. The first, one-answer, - uses one DNS message per resource record transferred. many-answers packs - as many resource records as possible into a message. many-answers is + The server supports two zone transfer methods. The first, one-answer, + uses one DNS message per resource record transferred. many-answers packs + as many resource records as possible into a message. many-answers is more efficient, but is only known to be understood by BIND 9, BIND 8.x, and patched versions of BIND 4.9.5. You can specify which method - to use for a server with the transfer-format option. - If transfer-format is not - specified, the transfer-format + to use for a server with the transfer-format option. + If transfer-format is not + specified, the transfer-format specified - by the options statement will be + by the options statement will be used.

    -

    transfers +

    transfers is used to limit the number of concurrent inbound zone transfers from the specified server. If no - transfers clause is specified, the + transfers clause is specified, the limit is set according to the - transfers-per-ns option. + transfers-per-ns option.

    - The keys clause identifies a - key_id defined by the key statement, - to be used for transaction security (TSIG, the section called “TSIG”) + The keys clause identifies a + key_id defined by the key statement, + to be used for transaction security (TSIG, the section called “TSIG”) when talking to the remote server. When a request is sent to the remote server, a request signature will be generated using the key specified here and appended to the @@ -6783,63 +6856,63 @@ ns.domain.com.rpz-nsdname CNAME . Only a single key per server is currently supported.

    - The transfer-source and - transfer-source-v6 clauses specify + The transfer-source and + transfer-source-v6 clauses specify the IPv4 and IPv6 source address to be used for zone transfer with the remote server, respectively. - For an IPv4 remote server, only transfer-source can + For an IPv4 remote server, only transfer-source can be specified. Similarly, for an IPv6 remote server, only - transfer-source-v6 can be + transfer-source-v6 can be specified. For more details, see the description of - transfer-source and - transfer-source-v6 in - the section called “Zone Transfers”. + transfer-source and + transfer-source-v6 in + the section called “Zone Transfers”.

    - The notify-source and - notify-source-v6 clauses specify the + The notify-source and + notify-source-v6 clauses specify the IPv4 and IPv6 source address to be used for notify messages sent to remote servers, respectively. For an - IPv4 remote server, only notify-source + IPv4 remote server, only notify-source can be specified. Similarly, for an IPv6 remote server, - only notify-source-v6 can be specified. + only notify-source-v6 can be specified.

    - The query-source and - query-source-v6 clauses specify the + The query-source and + query-source-v6 clauses specify the IPv4 and IPv6 source address to be used for queries sent to remote servers, respectively. For an IPv4 - remote server, only query-source can + remote server, only query-source can be specified. Similarly, for an IPv6 remote server, - only query-source-v6 can be specified. + only query-source-v6 can be specified.

    - The request-nsid clause determines + The request-nsid clause determines whether the local server will add a NSID EDNS option to requests sent to the server. This overrides - request-nsid set at the view or + request-nsid set at the view or option level.

    -
    +

    -statistics-channels Statement Grammar

    -
    statistics-channels {
+statistics-channels Statement Grammar
    +
    statistics-channels {
    [ inet ( ip_addr | * ) [ port ip_port ]
    [ allow {  address_match_list  } ]; ]
    [ inet ...; ]
 };
    -
    +

    -statistics-channels Statement Definition and +statistics-channels Statement Definition and Usage

    - The statistics-channels statement + The statistics-channels statement declares communication channels to be used by system administrators to get access to statistics information of the name server. @@ -6849,46 +6922,46 @@ ns.domain.com.rpz-nsdname CNAME . communication protocols in the future, but currently only HTTP access is supported. It requires that BIND 9 be compiled with libxml2; - the statistics-channels statement is + the statistics-channels statement is still accepted even if it is built without the library, but any HTTP access will fail with an error.

    - An inet control channel is a TCP socket - listening at the specified ip_port on the - specified ip_addr, which can be an IPv4 or IPv6 - address. An ip_addr of * (asterisk) is + An inet control channel is a TCP socket + listening at the specified ip_port on the + specified ip_addr, which can be an IPv4 or IPv6 + address. An ip_addr of * (asterisk) is interpreted as the IPv4 wildcard address; connections will be accepted on any of the system's IPv4 addresses. To listen on the IPv6 wildcard address, - use an ip_addr of ::. + use an ip_addr of ::.

    If no port is specified, port 80 is used for HTTP channels. The asterisk "*" cannot be used for - ip_port. + ip_port.

    The attempt of opening a statistics channel is - restricted by the optional allow clause. + restricted by the optional allow clause. Connections to the statistics channel are permitted based on the - address_match_list. - If no allow clause is present, - named accepts connection + address_match_list. + If no allow clause is present, + named accepts connection attempts from any address; since the statistics may contain sensitive internal information, it is highly recommended to restrict the source of connection requests appropriately.

    - If no statistics-channels statement is present, - named will not open any communication channels. + If no statistics-channels statement is present, + named will not open any communication channels.

    If the statistics channel is configured to listen on 127.0.0.1 port 8888, then the statistics are accessible in XML format at - http://127.0.0.1:8888/ or - http://127.0.0.1:8888/xml. A CSS file is + http://127.0.0.1:8888/ or + http://127.0.0.1:8888/xml. A CSS file is included which can format the XML statistics into tables when viewed with a stylesheet-capable browser. When BIND 9 is configured with --enable-newstats, @@ -6901,30 +6974,30 @@ ns.domain.com.rpz-nsdname CNAME .

    Applications that depend on a particular XML schema can request - http://127.0.0.1:8888/xml/v2 for version 2 + http://127.0.0.1:8888/xml/v2 for version 2 of the statistics XML schema or - http://127.0.0.1:8888/xml/v3 for version 3. + http://127.0.0.1:8888/xml/v3 for version 3. If the requested schema is supported by the server, then it will respond; if not, it will return a "page not found" error.

    -
    +

    -trusted-keys Statement Grammar

    -
    trusted-keys {
+trusted-keys Statement Grammar
    +
    trusted-keys {
     string number number number string ;
     [ string number number number string ; [...]]
 };
    -
    +

    -trusted-keys Statement Definition +trusted-keys Statement Definition and Usage

    - The trusted-keys statement defines - DNSSEC security roots. DNSSEC is described in the section called “DNSSEC”. A security root is defined when the + The trusted-keys statement defines + DNSSEC security roots. DNSSEC is described in the section called “DNSSEC”. A security root is defined when the public key for a non-authoritative zone is known, but cannot be securely obtained through DNS, either because it is the DNS root zone or because its parent zone is @@ -6935,14 +7008,14 @@ ns.domain.com.rpz-nsdname CNAME .

    All keys (and corresponding zones) listed in - trusted-keys are deemed to exist regardless + trusted-keys are deemed to exist regardless of what parent zones say. Similarly for all keys listed in - trusted-keys only those keys are + trusted-keys only those keys are used to validate the DNSKEY RRset. The parent's DS RRset will not be used.

    - The trusted-keys statement can contain + The trusted-keys statement can contain multiple key entries, each consisting of the key's domain name, flags, protocol, algorithm, and the Base-64 representation of the key data. @@ -6951,31 +7024,31 @@ ns.domain.com.rpz-nsdname CNAME . multiple lines.

    - trusted-keys may be set at the top level + trusted-keys may be set at the top level of named.conf or within a view. If it is set in both places, they are additive: keys defined at the top level are inherited by all views, but keys defined in a view are only used within that view.

    -
    +

    -managed-keys Statement Grammar

    -
    managed-keys {
+managed-keys Statement Grammar
    +
    managed-keys {
     name initial-key flags protocol algorithm key-data ;
     [ name initial-key flags protocol algorithm key-data ; [...]]
 };
    -
    +

    -managed-keys Statement Definition +managed-keys Statement Definition and Usage

    - The managed-keys statement, like - trusted-keys, defines DNSSEC + The managed-keys statement, like + trusted-keys, defines DNSSEC security roots. The difference is that - managed-keys can be kept up to date + managed-keys can be kept up to date automatically, without intervention from the resolver operator.

    @@ -6983,76 +7056,76 @@ ns.domain.com.rpz-nsdname CNAME . Suppose, for example, that a zone's key-signing key was compromised, and the zone owner had to revoke and replace the key. A resolver which had the old key in a - trusted-keys statement would be + trusted-keys statement would be unable to validate this zone any longer; it would reply with a SERVFAIL response code. This would continue until the resolver operator had updated the - trusted-keys statement with the new key. + trusted-keys statement with the new key.

    If, however, the zone were listed in a - managed-keys statement instead, then the + managed-keys statement instead, then the zone owner could add a "stand-by" key to the zone in advance. - named would store the stand-by key, and - when the original key was revoked, named + named would store the stand-by key, and + when the original key was revoked, named would be able to transition smoothly to the new key. It would also recognize that the old key had been revoked, and cease using that key to validate answers, minimizing the damage that the compromised key could do.

    - A managed-keys statement contains a list of + A managed-keys statement contains a list of the keys to be managed, along with information about how the keys are to be initialized for the first time. The only initialization method currently supported (as of BIND 9.7.0) is initial-key. - This means the managed-keys statement must + This means the managed-keys statement must contain a copy of the initializing key. (Future releases may allow keys to be initialized by other methods, eliminating this requirement.)

    - Consequently, a managed-keys statement - appears similar to a trusted-keys, differing + Consequently, a managed-keys statement + appears similar to a trusted-keys, differing in the presence of the second field, containing the keyword initial-key. The difference is, whereas the - keys listed in a trusted-keys continue to be + keys listed in a trusted-keys continue to be trusted until they are removed from named.conf, an initializing key listed - in a managed-keys statement is only trusted + in a managed-keys statement is only trusted once: for as long as it takes to load the managed key database and start the RFC 5011 key maintenance process.

    - The first time named runs with a managed key + The first time named runs with a managed key configured in named.conf, it fetches the DNSKEY RRset directly from the zone apex, and validates it - using the key specified in the managed-keys + using the key specified in the managed-keys statement. If the DNSKEY RRset is validly signed, then it is used as the basis for a new managed keys database.

    - From that point on, whenever named runs, it - sees the managed-keys statement, checks to + From that point on, whenever named runs, it + sees the managed-keys statement, checks to make sure RFC 5011 key maintenance has already been initialized for the specified domain, and if so, it simply moves on. The - key specified in the managed-keys is not + key specified in the managed-keys is not used to validate answers; it has been superseded by the key or keys stored in the managed keys database.

    - The next time named runs after a name + The next time named runs after a name has been removed from the - managed-keys statement, the corresponding + managed-keys statement, the corresponding zone will be removed from the managed keys database, and RFC 5011 key maintenance will no longer be used for that domain.

    - named only maintains a single managed keys - database; consequently, unlike trusted-keys, - managed-keys may only be set at the top + named only maintains a single managed keys + database; consequently, unlike trusted-keys, + managed-keys may only be set at the top level of named.conf, not within a view.

    @@ -7064,29 +7137,29 @@ ns.domain.com.rpz-nsdname CNAME . managed-keys.bind.jnl. They are committed to the master file as soon as possible afterward; in the case of the managed key database, this will usually occur within 30 - seconds. So, whenever named is using + seconds. So, whenever named is using automatic key maintenance, those two files can be expected to exist in the working directory. (For this reason among others, the working directory should be always be writable by - named.) + named.)

    - If the dnssec-validation option is - set to auto, named + If the dnssec-validation option is + set to auto, named will automatically initialize a managed key for the - root zone. Similarly, if the dnssec-lookaside + root zone. Similarly, if the dnssec-lookaside option is set to auto, - named will automatically initialize + named will automatically initialize a managed key for the zone dlv.isc.org. In both cases, the key that is used to initialize the key - maintenance process is built into named, - and can be overridden from bindkeys-file. + maintenance process is built into named, + and can be overridden from bindkeys-file.

    -
    +

    -view Statement Grammar

    -
    view view_name
+view Statement Grammar
    +
    view view_name
       [class] {
       match-clients { address_match_list };
       match-destinations { address_match_list };
@@ -7096,11 +7169,11 @@ ns.domain.com.rpz-nsdname   CNAME   .
 };
    -
    +

    -view Statement Definition and Usage

    +view Statement Definition and Usage

    - The view statement is a powerful + The view statement is a powerful feature of BIND 9 that lets a name server answer a DNS query differently @@ -7109,54 +7182,54 @@ ns.domain.com.rpz-nsdname CNAME . split DNS setups without having to run multiple servers.

    - Each view statement defines a view + Each view statement defines a view of the DNS namespace that will be seen by a subset of clients. A client matches a view if its source IP address matches the address_match_list of the view's - match-clients clause and its + match-clients clause and its destination IP address matches the address_match_list of the view's - match-destinations clause. If not + match-destinations clause. If not specified, both - match-clients and match-destinations + match-clients and match-destinations default to matching all addresses. In addition to checking IP addresses - match-clients and match-destinations - can also take keys which provide an + match-clients and match-destinations + can also take keys which provide an mechanism for the client to select the view. A view can also be specified - as match-recursive-only, which + as match-recursive-only, which means that only recursive requests from matching clients will match that view. - The order of the view statements is + The order of the view statements is significant — a client request will be resolved in the context of the first - view that it matches. + view that it matches.

    - Zones defined within a view + Zones defined within a view statement will - only be accessible to clients that match the view. + only be accessible to clients that match the view. By defining a zone of the same name in multiple views, different zone data can be given to different clients, for example, "internal" and "external" clients in a split DNS setup.

    - Many of the options given in the options statement - can also be used within a view + Many of the options given in the options statement + can also be used within a view statement, and then apply only when resolving queries with that view. When no view-specific - value is given, the value in the options statement + value is given, the value in the options statement is used as a default. Also, zone options can have default values specified - in the view statement; these + in the view statement; these view-specific defaults - take precedence over those in the options statement. + take precedence over those in the options statement.

    Views are class specific. If no class is given, class IN @@ -7164,24 +7237,24 @@ ns.domain.com.rpz-nsdname CNAME . since only the IN class has compiled-in default hints.

    - If there are no view statements in + If there are no view statements in the config file, a default view that matches any client is automatically created - in class IN. Any zone statements + in class IN. Any zone statements specified on the top level of the configuration file are considered to be part of - this default view, and the options + this default view, and the options statement will - apply to the default view. If any explicit view - statements are present, all zone + apply to the default view. If any explicit view + statements are present, all zone statements must - occur inside view statements. + occur inside view statements.

    Here is an example of a typical split DNS setup implemented - using view statements: + using view statements: 

    view "internal" {
       // This should match our internal networks.
@@ -7216,11 +7289,11 @@ view "external" {
 };
    -
    +

    -zone +zone Statement Grammar

    -
    zone zone_name [class] {
+
    zone zone_name [class] {
     type master;
     [ allow-query { address_match_list }; ]
     [ allow-query-on { address_match_list }; ]
@@ -7230,8 +7303,6 @@ view "external" {
     [ dnssec-dnskey-kskonly yes_or_no; ]
     [ dnssec-loadkeys-interval number; ]
     [ update-policy local | { update_policy_rule [...] }; ]
-    [ also-notify { ip_addr [port ip_port] ;
-                  [ ip_addr [port ip_port] ; ... ] }; ]
     [ check-names (warn|fail|ignore) ; ]
     [ check-mx (warn|fail|ignore) ; ]
     [ check-wildcard yes_or_no; ]
@@ -7371,7 +7442,7 @@ zone zone_name [ alt-transfer-source-v6 (ip6_addr | *)
                             [port ip_port] ; ]
     [ use-alt-transfer-source yes_or_no; ]
-    [ zone-statistics yes_or_no ; ]
+    [ zone-statistics full | terse | none; ]
     [ database string ; ]
     [ min-refresh-time number ; ]
     [ max-refresh-time number ; ]
@@ -7385,7 +7456,7 @@ zone zone_name [ allow-query { address_match_list }; ]
     [ server-addresses { [ ip_addr ; ... ] }; ]
     [ server-names { [ namelist ] }; ]
-    [ zone-statistics yes_or_no ; ]
+    [ zone-statistics full | terse | none; ]
 };
 
 zone zone_name [class] {
@@ -7408,16 +7479,25 @@ zone zone_name [
    -
    +

    -zone Statement Definition and Usage

    -
    +zone Statement Definition and Usage
    +

    -Zone Types

    +Zone Types
    +

    + The type keyword is required + for the zone configuration. Its + acceptable values include: delegation-only, + forward, hint, + master, redirect, + slave, static-stub, + and stub. +

    --++ @@ -7444,7 +7524,7 @@ zone zone_name [

    A slave zone is a replica of a master - zone. The masters list + zone. The masters list specifies one or more IP addresses of master servers that the slave contacts to update its copy of the zone. @@ -7559,14 +7639,14 @@ zone zone_name [

    Zone data is configured via the - server-addresses and - server-names zone options. + server-addresses and + server-names zone options.

    The zone data is maintained in the form of NS and (if necessary) glue A or AAAA RRs internally, which can be seen by dumping zone - databases by rndc dumpdb -all. + databases by rndc dumpdb -all. The configured RRs are considered local configuration parameters rather than public data. Non recursive queries (i.e., those with the RD @@ -7597,22 +7677,22 @@ zone zone_name [

    A "forward zone" is a way to configure - forwarding on a per-domain basis. A zone statement - of type forward can - contain a forward - and/or forwarders + forwarding on a per-domain basis. A zone statement + of type forward can + contain a forward + and/or forwarders statement, which will apply to queries within the domain given by the zone - name. If no forwarders + name. If no forwarders statement is present or - an empty list for forwarders is given, then no + an empty list for forwarders is given, then no forwarding will be done for the domain, canceling the effects of - any forwarders in the options statement. Thus + any forwarders in the options statement. Thus if you want to use this type of zone to change the behavior of the - global forward option + global forward option (that is, "forward first" to, then "forward only", or vice versa, but want to use the same @@ -7654,7 +7734,7 @@ zone zone_name [allow-query can be + per view. allow-query can be used to restrict which clients see these answers.

    @@ -7691,10 +7771,10 @@ zone zone_name [rndc reload + rndc reload zonename to reload a redirect zone. However, when using - rndc reload without specifying + rndc reload without specifying a zone name, redirect zones will be reloaded along with other zones.

    @@ -7722,16 +7802,16 @@ zone zone_name [

    - See caveats in root-delegation-only. + See caveats in root-delegation-only.

    -
    +

    -Class

    +Class

    The zone's name may optionally be followed by a class. If a class is not specified, class IN (for Internet), @@ -7751,48 +7831,48 @@ zone zone_name [CHAOS class.

    -
    +

    -Zone Options

    -
    -
    allow-notify
    +Zone Options
    +
    +
    allow-notify

    See the description of - allow-notify in the section called “Access Control”. + allow-notify in the section called “Access Control”.

    -
    allow-query
    +
    allow-query

    See the description of - allow-query in the section called “Access Control”. + allow-query in the section called “Access Control”.

    -
    allow-query-on
    +
    allow-query-on

    See the description of - allow-query-on in the section called “Access Control”. + allow-query-on in the section called “Access Control”.

    -
    allow-transfer
    +
    allow-transfer

    - See the description of allow-transfer - in the section called “Access Control”. + See the description of allow-transfer + in the section called “Access Control”.

    -
    allow-update
    +
    allow-update

    - See the description of allow-update - in the section called “Access Control”. + See the description of allow-update + in the section called “Access Control”.

    -
    update-policy
    +
    update-policy

    Specifies a "Simple Secure Update" policy. See - the section called “Dynamic Update Policies”. + the section called “Dynamic Update Policies”.

    -
    allow-update-forwarding
    +
    allow-update-forwarding

    - See the description of allow-update-forwarding - in the section called “Access Control”. + See the description of allow-update-forwarding + in the section called “Access Control”.

    -
    also-notify
    +
    also-notify

    - Only meaningful if notify + Only meaningful if notify is active for this zone. The set of machines that will receive a @@ -7801,85 +7881,90 @@ zone zone_name [also-notify. A port + with also-notify. A port may be specified - with each also-notify + with each also-notify address to send the notify messages to a port other than the default of 53. A TSIG key may also be specified to cause the NOTIFY to be signed by the given key. - also-notify is not + also-notify is not meaningful for stub zones. The default is the empty list.

    -
    check-names
    +
    check-names

    This option is used to restrict the character set and syntax of certain domain names in master files and/or DNS responses received from the - network. The default varies according to zone type. For master zones the default is fail. For slave - zones the default is warn. - It is not implemented for hint zones. + network. The default varies according to zone type. For master zones the default is fail. For slave + zones the default is warn. + It is not implemented for hint zones.

    -
    check-mx
    +
    check-mx

    See the description of - check-mx in the section called “Boolean Options”. + check-mx in the section called “Boolean Options”.

    -
    check-spf
    +
    check-spf

    See the description of - check-spf in the section called “Boolean Options”. + check-spf in the section called “Boolean Options”.

    -
    check-wildcard
    +
    check-wildcard

    See the description of - check-wildcard in the section called “Boolean Options”. + check-wildcard in the section called “Boolean Options”.

    -
    check-integrity
    +
    check-integrity

    See the description of - check-integrity in the section called “Boolean Options”. + check-integrity in the section called “Boolean Options”.

    -
    check-sibling
    +
    check-sibling

    See the description of - check-sibling in the section called “Boolean Options”. + check-sibling in the section called “Boolean Options”.

    -
    zero-no-soa-ttl
    +
    zero-no-soa-ttl

    See the description of - zero-no-soa-ttl in the section called “Boolean Options”. + zero-no-soa-ttl in the section called “Boolean Options”.

    -
    update-check-ksk
    +
    update-check-ksk

    See the description of - update-check-ksk in the section called “Boolean Options”. + update-check-ksk in the section called “Boolean Options”.

    -
    dnssec-update-mode
    +
    dnssec-loadkeys-interval

    See the description of - dnssec-update-mode in the section called “options Statement Definition and + dnssec-loadkeys-interval in the section called “options Statement Definition and Usage”.

    -
    dnssec-dnskey-kskonly
    +
    dnssec-update-mode

    See the description of - dnssec-dnskey-kskonly in the section called “Boolean Options”. + dnssec-update-mode in the section called “options Statement Definition and + Usage”.

    -
    try-tcp-refresh
    +
    dnssec-dnskey-kskonly

    See the description of - try-tcp-refresh in the section called “Boolean Options”. + dnssec-dnskey-kskonly in the section called “Boolean Options”.

    -
    database
    +
    try-tcp-refresh
    +

    + See the description of + try-tcp-refresh in the section called “Boolean Options”. +

    +
    database

    Specify the type of database to be used for storing the - zone data. The string following the database keyword + zone data. The string following the database keyword is interpreted as a list of whitespace-delimited words. The first word identifies the database type, and any subsequent words are @@ -7901,12 +7986,12 @@ zone zone_name [

    -
    dialup
    +
    dialup

    See the description of - dialup in the section called “Boolean Options”. + dialup in the section called “Boolean Options”.

    -
    delegation-only
    +
    delegation-only

    The flag only applies to forward, hint and stub @@ -7915,25 +8000,25 @@ zone zone_name [

    - See caveats in root-delegation-only. + See caveats in root-delegation-only.

    -
    forward
    +
    forward

    Only meaningful if the zone has a forwarders - list. The only value causes + list. The only value causes the lookup to fail - after trying the forwarders and getting no answer, while first would + after trying the forwarders and getting no answer, while first would allow a normal lookup to be tried.

    -
    forwarders
    +
    forwarders

    Used to override the list of global forwarders. - If it is not specified in a zone of type forward, + If it is not specified in a zone of type forward, no forwarding is done for the zone and the global options are not used.

    -
    ixfr-base
    +
    ixfr-base

    Was used in BIND 8 to specify the name @@ -7945,59 +8030,59 @@ zone zone_name [

    -
    ixfr-tmp-file
    +
    ixfr-tmp-file

    Was an undocumented option in BIND 8. Ignored in BIND 9.

    -
    journal
    +
    journal

    Allow the default journal's filename to be overridden. The default is the zone's filename with ".jnl" appended. - This is applicable to master and slave zones. + This is applicable to master and slave zones.

    -
    max-journal-size
    +
    max-journal-size

    See the description of - max-journal-size in the section called “Server Resource Limits”. + max-journal-size in the section called “Server Resource Limits”.

    -
    max-transfer-time-in
    +
    max-transfer-time-in

    See the description of - max-transfer-time-in in the section called “Zone Transfers”. + max-transfer-time-in in the section called “Zone Transfers”.

    -
    max-transfer-idle-in
    +
    max-transfer-idle-in

    See the description of - max-transfer-idle-in in the section called “Zone Transfers”. + max-transfer-idle-in in the section called “Zone Transfers”.

    -
    max-transfer-time-out
    +
    max-transfer-time-out

    See the description of - max-transfer-time-out in the section called “Zone Transfers”. + max-transfer-time-out in the section called “Zone Transfers”.

    -
    max-transfer-idle-out
    +
    max-transfer-idle-out

    See the description of - max-transfer-idle-out in the section called “Zone Transfers”. + max-transfer-idle-out in the section called “Zone Transfers”.

    -
    notify
    +
    notify

    See the description of - notify in the section called “Boolean Options”. + notify in the section called “Boolean Options”.

    -
    notify-delay
    +
    notify-delay

    See the description of - notify-delay in the section called “Tuning”. + notify-delay in the section called “Tuning”.

    -
    notify-to-soa
    +
    notify-to-soa

    See the description of - notify-to-soa in - the section called “Boolean Options”. + notify-to-soa in + the section called “Boolean Options”.

    -
    pubkey
    +
    pubkey

    In BIND 8, this option was intended for specifying @@ -8006,15 +8091,14 @@ zone zone_name [BIND 9 does not verify signatures on load and ignores the option.

    -
    zone-statistics
    +
    zone-statistics

    - If yes, the server will keep - statistical - information for this zone, which can be dumped to the - statistics-file defined in - the server options. + See the description of + zone-statistics in + the section called “options Statement Definition and + Usage”.

    -
    server-addresses
    +
    server-addresses

    Only meaningful for static-stub zones. @@ -8028,7 +8112,7 @@ zone zone_name [ For example, if "example.com" is configured as a static-stub zone with 192.0.2.1 and 2001:db8::1234 - in a server-addresses option, + in a server-addresses option, the following RRs will be internally configured. 

    example.com. NS example.com.
@@ -8043,7 +8127,7 @@ example.com. AAAA 2001:db8::1234
    queries to 192.0.2.1 and/or 2001:db8::1234.

    -
    server-names
    +
    server-names

    Only meaningful for static-stub zones. @@ -8051,7 +8135,7 @@ example.com. AAAA 2001:db8::1234 act as authoritative servers of the static-stub zone. These names will be resolved to IP addresses when - named needs to send queries to + named needs to send queries to these servers. To make this supplemental resolution successful, these names must not be a subdomain of the origin @@ -8059,7 +8143,7 @@ example.com. AAAA 2001:db8::1234 That is, when "example.net" is the origin of a static-stub zone, "ns.example" and "master.example.com" can be specified in the - server-names option, but + server-names option, but "ns.example.net" cannot, and will be rejected by the configuration parser.

    @@ -8069,7 +8153,7 @@ example.com. AAAA 2001:db8::1234 For example, if "example.com" is configured as a static-stub zone with "ns1.example.net" and "ns2.example.net" - in a server-names option, + in a server-names option, the following RRs will be internally configured. 

    example.com. NS ns1.example.net.
@@ -8086,146 +8170,97 @@ example.com. NS ns2.example.net.
                     queries to (one or more of) these addresses.
    -
    sig-validity-interval
    +
    sig-validity-interval

    See the description of - sig-validity-interval in the section called “Tuning”. + sig-validity-interval in the section called “Tuning”.

    -
    sig-signing-nodes
    +
    sig-signing-nodes

    See the description of - sig-signing-nodes in the section called “Tuning”. + sig-signing-nodes in the section called “Tuning”.

    -
    sig-signing-signatures
    +
    sig-signing-signatures

    See the description of - sig-signing-signatures in the section called “Tuning”. + sig-signing-signatures in the section called “Tuning”.

    -
    sig-signing-type
    +
    sig-signing-type

    See the description of - sig-signing-type in the section called “Tuning”. + sig-signing-type in the section called “Tuning”.

    -
    transfer-source
    +
    transfer-source

    See the description of - transfer-source in the section called “Zone Transfers”. + transfer-source in the section called “Zone Transfers”.

    -
    transfer-source-v6
    +
    transfer-source-v6

    See the description of - transfer-source-v6 in the section called “Zone Transfers”. + transfer-source-v6 in the section called “Zone Transfers”.

    -
    alt-transfer-source
    +
    alt-transfer-source

    See the description of - alt-transfer-source in the section called “Zone Transfers”. + alt-transfer-source in the section called “Zone Transfers”.

    -
    alt-transfer-source-v6
    +
    alt-transfer-source-v6

    See the description of - alt-transfer-source-v6 in the section called “Zone Transfers”. + alt-transfer-source-v6 in the section called “Zone Transfers”.

    -
    use-alt-transfer-source
    +
    use-alt-transfer-source

    See the description of - use-alt-transfer-source in the section called “Zone Transfers”. + use-alt-transfer-source in the section called “Zone Transfers”.

    -
    notify-source
    +
    notify-source

    See the description of - notify-source in the section called “Zone Transfers”. + notify-source in the section called “Zone Transfers”.

    -
    notify-source-v6
    +
    notify-source-v6

    See the description of - notify-source-v6 in the section called “Zone Transfers”. + notify-source-v6 in the section called “Zone Transfers”.

    -min-refresh-time, max-refresh-time, min-retry-time, max-retry-time +min-refresh-time, max-refresh-time, min-retry-time, max-retry-time

    - See the description in the section called “Tuning”. + See the description in the section called “Tuning”.

    -
    ixfr-from-differences
    +
    ixfr-from-differences

    See the description of - ixfr-from-differences in the section called “Boolean Options”. - (Note that the ixfr-from-differences + ixfr-from-differences in the section called “Boolean Options”. + (Note that the ixfr-from-differences master and slave choices are not available at the zone level.)

    -
    key-directory
    +
    key-directory

    See the description of - key-directory in the section called “options Statement Definition and + key-directory in the section called “options Statement Definition and Usage”.

    -
    auto-dnssec
    -
    -

    - Zones configured for dynamic DNS may also use this - option to allow varying levels of automatic DNSSEC key - management. There are three possible settings: -

    -

    - auto-dnssec allow; permits - keys to be updated and the zone fully re-signed - whenever the user issues the command rndc sign - zonename. -

    -

    - auto-dnssec maintain; includes the - above, but also automatically adjusts the zone's DNSSEC - keys on schedule, according to the keys' timing metadata - (see dnssec-keygen(8) and - dnssec-settime(8)). The command - rndc sign - zonename causes - named to load keys from the key - repository and sign the zone with all keys that are - active. - rndc loadkeys - zonename causes - named to load keys from the key - repository and schedule key maintenance events to occur - in the future, but it does not sign the full zone - immediately. Note: once keys have been loaded for a - zone the first time, the repository will be searched - for changes periodically, regardless of whether - rndc loadkeys is used. The recheck - interval is defined by - dnssec-loadkeys-interval.) -

    -

    - The default setting is auto-dnssec off. -

    -
    -
    serial-update-method
    -
    -

    - Zones configured for dynamic DNS may use this - option to set the update method that will be used for - the zone serial number in the SOA record. -

    -

    - With the default setting of - serial-update-method increment;, the - SOA serial number will be incremented by one each time - the zone is updated. -

    -

    - When set to - serial-update-method unixtime;, the - SOA serial number will be set to the number of seconds - since the UNIX epoch, unless the serial number is - already greater than or equal to that value, in which - case it is simply incremented by one. -

    -
    -
    inline-signing
    +
    auto-dnssec
    +

    + See the description of + auto-dnssec in + the section called “options Statement Definition and + Usage”. +

    +
    serial-update-method
    +

    + See the description of + serial-update-method in + the section called “options Statement Definition and + Usage”. +

    +
    inline-signing

    If yes, this enables "bump in the wire" signing of a zone, where a @@ -8234,40 +8269,40 @@ example.com. NS ns2.example.net. with possibly, a different serial number. This behaviour is disabled by default.

    -
    multi-master
    +
    multi-master

    - See the description of multi-master in - the section called “Boolean Options”. + See the description of multi-master in + the section called “Boolean Options”.

    -
    masterfile-format
    +
    masterfile-format

    - See the description of masterfile-format - in the section called “Tuning”. + See the description of masterfile-format + in the section called “Tuning”.

    -
    dnssec-secure-to-insecure
    +
    dnssec-secure-to-insecure

    See the description of - dnssec-secure-to-insecure in the section called “Boolean Options”. + dnssec-secure-to-insecure in the section called “Boolean Options”.

    -
    +

    Dynamic Update Policies

    BIND 9 supports two alternative methods of granting clients the right to perform dynamic updates to a zone, configured by the - allow-update and - update-policy option, respectively. + allow-update and + update-policy option, respectively.

    - The allow-update clause works the + The allow-update clause works the same way as in previous versions of BIND. It grants given clients the permission to update any record of any name in the zone.

    - The update-policy clause + The update-policy clause allows more fine-grained control over what updates are allowed. A set of rules is specified, where each rule either grants or denies permissions for one or more @@ -8277,29 +8312,29 @@ example.com. NS ns2.example.net. identity of the signer can be determined.

    - Rules are specified in the update-policy + Rules are specified in the update-policy zone option, and are only meaningful for master zones. - When the update-policy statement + When the update-policy statement is present, it is a configuration error for the - allow-update statement to be - present. The update-policy statement + allow-update statement to be + present. The update-policy statement only examines the signer of a message; the source address is not relevant.

    - There is a pre-defined update-policy + There is a pre-defined update-policy rule which can be switched on with the command - update-policy local;. + update-policy local;. Switching on this rule in a zone causes - named to generate a TSIG session + named to generate a TSIG session key and place it in a file, and to allow that key to update the zone. (By default, the file is /var/run/named/session.key, the key name is "local-ddns" and the key algorithm is HMAC-SHA256, but these values are configurable with the - session-keyfile, - session-keyname and - session-keyalg options, respectively). + session-keyfile, + session-keyname and + session-keyalg options, respectively).

    A client running on the local system, and with appropriate @@ -8311,14 +8346,14 @@ example.com. NS ns2.example.net. 

    update-policy { grant local-ddns zonesub any; };

    - The command nsupdate -l sends update + The command nsupdate -l sends update requests to localhost, and signs them using the session key.

    Other rule definitions look like this: 

    -( grant | deny ) identity nametype [ name ] [ types ]
+( grant | deny ) identity nametype [ name ] [ types ]

    Each rule grants or denies privileges. Once a message has @@ -8373,8 +8408,8 @@ example.com. NS ns2.example.net.

    --++ @@ -8418,10 +8453,10 @@ example.com. NS ns2.example.net. This rule is similar to subdomain, except that it matches when the name being updated is a subdomain of the zone in which the - update-policy statement + update-policy statement appears. This obviates the need to type the zone name twice, and enables the use of a standard - update-policy statement in + update-policy statement in multiple zones without modification.

    @@ -8441,7 +8476,7 @@ example.com. NS ns2.example.net. The name field is subject to DNS wildcard expansion, and this rule matches when the name being updated - name is a valid expansion of the wildcard. + is a valid expansion of the wildcard.

    @@ -8614,7 +8649,7 @@ example.com. NS ns2.example.net.

    - This rule allows named + This rule allows named to defer the decision of whether to allow a given update to an external daemon.

    @@ -8668,10 +8703,10 @@ example.com. NS ns2.example.net. -
    +

    -Zone File

    -
    +Zone File
    +

    Types of Resource Records and When to Use Them

    @@ -8681,9 +8716,9 @@ example.com. NS ns2.example.net. identified and implemented in the DNS. These are also included.

    -
    +

    -Resource Records

    +Resource Records

    A domain name identifies a node. Each node has a set of resource information, which may be empty. The set of resource @@ -8692,15 +8727,15 @@ example.com. NS ns2.example.net. need not be preserved by name servers, resolvers, or other parts of the DNS. However, sorting of multiple RRs is permitted for optimization purposes, for example, to specify - that a particular nearby server be tried first. See the section called “The sortlist Statement” and the section called “RRset Ordering”. + that a particular nearby server be tried first. See the section called “The sortlist Statement” and the section called “RRset Ordering”.

    The components of a Resource Record are:

    --++ @@ -8778,8 +8813,8 @@ example.com. NS ns2.example.net.

    --++ @@ -8862,6 +8897,18 @@ example.com. NS ns2.example.net. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +

    + AVC +

    +     		+

    + Application Visibility and Control record. +

    +

    CAA @@ -8928,6 +8975,19 @@ example.com. NS ns2.example.net.

    +

    + CSYNC +

    +     		+

    + Child-to-Parent Synchronization in DNS as described + in RFC 7477. +

    +

    DHCID @@ -9306,6 +9366,18 @@ example.com. NS ns2.example.net.

    +

    + NINFO +

    +     		+

    + Contains zone status information. +

    +

    NIMLOC @@ -9476,6 +9548,18 @@ example.com. NS ns2.example.net.

    +

    + RKEY +

    +     		+

    + Resource key. +

    +

    RP @@ -9532,6 +9616,30 @@ example.com. NS ns2.example.net.

    +

    + SINK +

    +     		+

    + The kitchen sink record. +

    +
    +

    + SMIMEA +

    +     		+

    + The S/MIME Security Certificate Association. +

    +

    SOA @@ -9584,6 +9692,30 @@ example.com. NS ns2.example.net.

    +

    + TA +

    +     		+

    + Trust Anchor. Experimental. +

    +
    +

    + TALINK +

    +     		+

    + Trust Anchor Link. Experimental. +

    +

    TLSA @@ -9691,8 +9823,8 @@ example.com. NS ns2.example.net.

    --++ @@ -9781,9 +9913,9 @@ example.com. NS ns2.example.net. used as "pointers" to other data in the DNS.

    -
    +

    -Textual expression of RRs

    +Textual expression of RRs

    RRs are represented in binary form in the packets of the DNS protocol, and are usually represented in highly encoded form @@ -9823,9 +9955,9 @@ example.com. NS ns2.example.net.

    ---+++ @@ -9941,9 +10073,9 @@ example.com. NS ns2.example.net.

    ---+++ @@ -9984,9 +10116,9 @@ example.com. NS ns2.example.net.

    -
    +

    -Discussion of MX Records

    +Discussion of MX Records

    As described above, domain servers store information as a series of resource records, each of which contains a particular @@ -10024,11 +10156,11 @@ example.com. NS ns2.example.net.

    -----+++++ @@ -10167,7 +10299,7 @@ example.com. NS ns2.example.net. be attempted.

    -
    +

    Setting TTLs

    @@ -10180,8 +10312,8 @@ example.com. NS ns2.example.net.

    --++ @@ -10239,9 +10371,9 @@ example.com. NS ns2.example.net. can be explicitly specified, for example, 1h30m.

    -
    +

    -Inverse Mapping in IPv4

    +Inverse Mapping in IPv4

    Reverse name resolution (that is, translation from IP address to name) is achieved by means of the in-addr.arpa domain @@ -10259,8 +10391,8 @@ example.com. NS ns2.example.net.

    --++ @@ -10292,7 +10424,7 @@ example.com. NS ns2.example.net.

    Note

    - The $ORIGIN lines in the examples + The $ORIGIN lines in the examples are for providing context to the examples only — they do not necessarily appear in the actual usage. They are only used here to indicate @@ -10300,9 +10432,9 @@ example.com. NS ns2.example.net.

    -
    +

    -Other Zone File Directives

    +Other Zone File Directives

    The Master File Format was initially defined in RFC 1035 and has subsequently been extended. While the Master File Format @@ -10312,12 +10444,12 @@ example.com. NS ns2.example.net. class.

    - Master File Directives include $ORIGIN, $INCLUDE, - and $TTL. + Master File Directives include $ORIGIN, $INCLUDE, + and $TTL.

    -
    +

    -The @ (at-sign)

    +The @ (at-sign)

    When used in the label (or name) field, the asperand or at-sign (@) symbol represents the current origin. @@ -10326,22 +10458,22 @@ example.com. NS ns2.example.net. trailing dot).

    -
    +

    -The $ORIGIN Directive

    +The $ORIGIN Directive

    - Syntax: $ORIGIN + Syntax: $ORIGIN domain-name [comment]

    -

    $ORIGIN +

    $ORIGIN sets the domain name that will be appended to any unqualified records. When a zone is first read in there - is an implicit $ORIGIN - <zone_name>. + is an implicit $ORIGIN + <zone_name>. (followed by trailing dot). - The current $ORIGIN is appended to - the domain specified in the $ORIGIN + The current $ORIGIN is appended to + the domain specified in the $ORIGIN argument if it is not absolute. 

    @@ -10355,11 +10487,11 @@ WWW     CNAME   MAIN-SERVER
 WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
    -
    +

    -The $INCLUDE Directive

    +The $INCLUDE Directive

    - Syntax: $INCLUDE + Syntax: $INCLUDE filename [ origin ] @@ -10367,14 +10499,14 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.

    Read and process the file filename as - if it were included into the file at this point. If origin is - specified the file is processed with $ORIGIN set - to that value, otherwise the current $ORIGIN is + if it were included into the file at this point. If origin is + specified the file is processed with $ORIGIN set + to that value, otherwise the current $ORIGIN is used.

    The origin and the current domain name - revert to the values they had prior to the $INCLUDE once + revert to the values they had prior to the $INCLUDE once the file has been read.

    @@ -10382,7 +10514,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.

    RFC 1035 specifies that the current origin should be restored after - an $INCLUDE, but it is silent + an $INCLUDE, but it is silent on whether the current domain name should also be restored. BIND 9 restores both of them. @@ -10391,11 +10523,11 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.

    -
    +

    -The $TTL Directive

    +The $TTL Directive

    - Syntax: $TTL + Syntax: $TTL default-ttl [ comment ] @@ -10405,16 +10537,16 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. with undefined TTLs. Valid TTLs are of the range 0-2147483647 seconds.

    -

    $TTL +

    $TTL is defined in RFC 2308.

    -
    +

    -BIND Master File Extension: the $GENERATE Directive

    +BIND Master File Extension: the $GENERATE Directive

    - Syntax: $GENERATE + Syntax: $GENERATE range lhs [ttl] @@ -10423,10 +10555,10 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. rhs [comment]

    -

    $GENERATE +

    $GENERATE is used to create a series of resource records that only differ from each other by an - iterator. $GENERATE can be used to + iterator. $GENERATE can be used to easily generate the sets of records required to support sub /24 reverse delegations described in RFC 2317: Classless IN-ADDR.ARPA delegation. @@ -10468,13 +10600,13 @@ HOST-127.EXAMPLE. MX 0 .

    --++
    -

    range

    +

    range

    @@ -10488,43 +10620,43 @@ HOST-127.EXAMPLE. MX 0 .

    -

    lhs

    +

    lhs

    This describes the owner name of the resource records - to be created. Any single $ + to be created. Any single $ (dollar sign) - symbols within the lhs string + symbols within the lhs string are replaced by the iterator value. To get a $ in the output, you need to escape the - $ using a backslash - \, - e.g. \$. The - $ may optionally be followed + $ using a backslash + \, + e.g. \$. The + $ may optionally be followed by modifiers which change the offset from the iterator, field width and base. Modifiers are introduced by a - { (left brace) immediately following the - $ as - ${offset[,width[,base]]}. - For example, ${-20,3,d} + { (left brace) immediately following the + $ as + ${offset[,width[,base]]}. + For example, ${-20,3,d} subtracts 20 from the current value, prints the result as a decimal in a zero-padded field of width 3. Available output forms are decimal - (d), octal - (o), hexadecimal - (x or X + (d), octal + (o), hexadecimal + (x or X for uppercase) and nibble - (n or N\ + (n or N\ for uppercase). The default modifier is - ${0,0,d}. If the - lhs is not absolute, the - current $ORIGIN is appended + ${0,0,d}. If the + lhs is not absolute, the + current $ORIGIN is appended to the name.

    @@ -10536,14 +10668,14 @@ HOST-127.EXAMPLE. MX 0 .

    For compatibility with earlier versions, - $$ is still recognized as + $$ is still recognized as indicating a literal $ in the output.

    -

    ttl

    +

    ttl

    @@ -10551,15 +10683,15 @@ HOST-127.EXAMPLE. MX 0 . not specified this will be inherited using the normal TTL inheritance rules.

    -

    class - and ttl can be +

    class + and ttl can be entered in either order.

    -

    class

    +

    class

    @@ -10567,15 +10699,15 @@ HOST-127.EXAMPLE. MX 0 . This must match the zone class if it is specified.

    -

    class - and ttl can be +

    class + and ttl can be entered in either order.

    -

    type

    +

    type

    @@ -10585,25 +10717,25 @@ HOST-127.EXAMPLE. MX 0 .

    -

    rhs

    +

    rhs

    - rhs, optionally, quoted string. + rhs, optionally, quoted string.

    - The $GENERATE directive is a BIND extension + The $GENERATE directive is a BIND extension and not part of the standard zone file format.

    BIND 8 does not support the optional TTL and CLASS fields.

    -
    +

    Additional File Formats

    @@ -10619,20 +10751,20 @@ HOST-127.EXAMPLE. MX 0 . For a primary server, a zone file in the raw format is expected to be generated from a textual zone file by the - named-compilezone command. For a + named-compilezone command. For a secondary server or for a dynamic zone, it is automatically generated (if this format is specified by the - masterfile-format option) when - named dumps the zone contents after + masterfile-format option) when + named dumps the zone contents after zone transfer or when applying prior updates.

    If a zone file in a binary format needs manual modification, it first must be converted to a textual form by the - named-compilezone command. All + named-compilezone command. All necessary modification should go to the text file, which should then be converted to the binary form by the - named-compilezone command again. + named-compilezone command again.

    Although the raw format uses the @@ -10646,7 +10778,7 @@ HOST-127.EXAMPLE. MX 0 .

    -
    +

    BIND9 Statistics

    @@ -10664,8 +10796,8 @@ HOST-127.EXAMPLE. MX 0 .

    --++ @@ -10764,30 +10896,35 @@ HOST-127.EXAMPLE. MX 0 .

    A subset of Name Server Statistics is collected and shown per zone for which the server has the authority when - zone-statistics is set to - yes. - These statistics counters are shown with their zone and view - names. - In some cases the view names are omitted for the default view. + zone-statistics is set to + full (or yes + for backward compatibility. See the description of + zone-statistics in the section called “options Statement Definition and + Usage” + for further details.

    +

    + These statistics counters are shown with their zone and + view names. The view name is omitted when the server is + not configured with explicit views.

    There are currently two user interfaces to get access to the statistics. One is in the plain text format dumped to the file specified - by the statistics-file configuration option. + by the statistics-file configuration option. The other is remotely accessible via a statistics channel - when the statistics-channels statement + when the statistics-channels statement is specified in the configuration file - (see the section called “statistics-channels Statement Grammar”.) + (see the section called “statistics-channels Statement Grammar”.)

    -
    -

    -The Statistics File

    +
    +

    +The Statistics File

    The text format statistics dump begins with a line, like:

    - +++ Statistics Dump +++ (973798949) + +++ Statistics Dump +++ (973798949)

    The number in parentheses is a standard @@ -10799,7 +10936,7 @@ HOST-127.EXAMPLE. MX 0 . Each section begins with a line, like:

    - ++ Name Server Statistics ++ + ++ Name Server Statistics ++

    Each section consists of lines, each containing the statistics @@ -10813,10 +10950,10 @@ HOST-127.EXAMPLE. MX 0 . number is identical to the number in the beginning line; for example:

    - --- Statistics Dump --- (973798949) + --- Statistics Dump --- (973798949)

    -
    +

    Statistics Counters

    @@ -10835,14 +10972,14 @@ HOST-127.EXAMPLE. MX 0 . it gives the corresponding counter name of the BIND 8 statistics, if applicable.

    -
    +

    -Name Server Statistics Counters

    +Name Server Statistics Counters
    ---+++ @@ -10864,10 +11001,10 @@ HOST-127.EXAMPLE. MX 0 .
    -

    Requestv4

    +

    Requestv4

    		 -

    RQ

    +

    RQ

    @@ -10878,10 +11015,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    Requestv6

    +

    Requestv6

    		 -

    RQ

    +

    RQ

    @@ -10892,10 +11029,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    ReqEdns0

    +

    ReqEdns0

    		 -

    +

    @@ -10905,10 +11042,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    ReqBadEDNSVer

    +

    ReqBadEDNSVer

    		 -

    +

    @@ -10918,10 +11055,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    ReqTSIG

    +

    ReqTSIG

    		 -

    +

    @@ -10931,10 +11068,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    ReqSIG0

    +

    ReqSIG0

    		 -

    +

    @@ -10944,10 +11081,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    ReqBadSIG

    +

    ReqBadSIG

    		 -

    +

    @@ -10957,10 +11094,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    ReqTCP

    +

    ReqTCP

    		 -

    RTCP

    +

    RTCP

    @@ -10970,10 +11107,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    AuthQryRej

    +

    AuthQryRej

    		 -

    RUQ

    +

    RUQ

    @@ -10983,10 +11120,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    RecQryRej

    +

    RecQryRej

    		 -

    RURQ

    +

    RURQ

    @@ -10996,10 +11133,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    XfrRej

    +

    XfrRej

    		 -

    RUXFR

    +

    RUXFR

    @@ -11009,10 +11146,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    UpdateRej

    +

    UpdateRej

    		 -

    RUUpd

    +

    RUUpd

    @@ -11022,10 +11159,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    Response

    +

    Response

    		 -

    SAns

    +

    SAns

    @@ -11035,10 +11172,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    RespTruncated

    +

    RespTruncated

    		 -

    +

    @@ -11048,10 +11185,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    RespEDNS0

    +

    RespEDNS0

    		 -

    +

    @@ -11061,10 +11198,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    RespTSIG

    +

    RespTSIG

    		 -

    +

    @@ -11074,10 +11211,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    RespSIG0

    +

    RespSIG0

    		 -

    +

    @@ -11087,10 +11224,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    QrySuccess

    +

    QrySuccess

    		 -

    +

    @@ -11098,7 +11235,7 @@ HOST-127.EXAMPLE. MX 0 . This means the query which returns a NOERROR response with at least one answer RR. This corresponds to the - success counter + success counter of previous versions of BIND 9.

    @@ -11106,10 +11243,10 @@ HOST-127.EXAMPLE. MX 0 .
    -

    QryAuthAns

    +

    QryAuthAns

    		 -

    +

    @@ -11119,10 +11256,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    QryNoauthAns

    +

    QryNoauthAns

    		 -

    SNaAns

    +

    SNaAns

    @@ -11132,16 +11269,16 @@ HOST-127.EXAMPLE. MX 0 .

    -

    QryReferral

    +

    QryReferral

    		 -

    +

    Queries resulted in referral answer. This corresponds to the - referral counter + referral counter of previous versions of BIND 9.

    @@ -11149,16 +11286,16 @@ HOST-127.EXAMPLE. MX 0 .
    -

    QryNxrrset

    +

    QryNxrrset

    		 -

    +

    Queries resulted in NOERROR responses with no data. This corresponds to the - nxrrset counter + nxrrset counter of previous versions of BIND 9.

    @@ -11166,10 +11303,10 @@ HOST-127.EXAMPLE. MX 0 .
    -

    QrySERVFAIL

    +

    QrySERVFAIL

    		 -

    SFail

    +

    SFail

    @@ -11179,10 +11316,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    QryFORMERR

    +

    QryFORMERR

    		 -

    SFErr

    +

    SFErr

    @@ -11192,16 +11329,16 @@ HOST-127.EXAMPLE. MX 0 .

    -

    QryNXDOMAIN

    +

    QryNXDOMAIN

    		 -

    SNXD

    +

    SNXD

    Queries resulted in NXDOMAIN. This corresponds to the - nxdomain counter + nxdomain counter of previous versions of BIND 9.

    @@ -11209,17 +11346,17 @@ HOST-127.EXAMPLE. MX 0 .
    -

    QryRecursion

    +

    QryRecursion

    		 -

    RFwdQ

    +

    RFwdQ

    Queries which caused the server to perform recursion in order to find the final answer. This corresponds to the - recursion counter + recursion counter of previous versions of BIND 9.

    @@ -11227,10 +11364,10 @@ HOST-127.EXAMPLE. MX 0 .
    -

    QryDuplicate

    +

    QryDuplicate

    		 -

    RDupQ

    +

    RDupQ

    @@ -11239,7 +11376,7 @@ HOST-127.EXAMPLE. MX 0 . IP address, port, query ID, name, type and class already being processed. This corresponds to the - duplicate counter + duplicate counter of previous versions of BIND 9.

    @@ -11247,10 +11384,10 @@ HOST-127.EXAMPLE. MX 0 .
    -

    QryDropped

    +

    QryDropped

    		 -

    +

    @@ -11260,14 +11397,14 @@ HOST-127.EXAMPLE. MX 0 . class and were subsequently dropped. This is the number of dropped queries due to the reason explained with the - clients-per-query + clients-per-query and - max-clients-per-query + max-clients-per-query options (see the description about - clients-per-query.) + clients-per-query.) This corresponds to the - dropped counter + dropped counter of previous versions of BIND 9.

    @@ -11275,23 +11412,23 @@ HOST-127.EXAMPLE. MX 0 .
    -

    QryFailure

    +

    QryFailure

    		 -

    +

    Other query failures. This corresponds to the - failure counter + failure counter of previous versions of BIND 9. Note: this counter is provided mainly for backward compatibility with the previous versions. Normally a more fine-grained counters such as - AuthQryRej and - RecQryRej + AuthQryRej and + RecQryRej that would also fall into this counter are provided, and so this counter would not be of much interest in practice. @@ -11300,10 +11437,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    XfrReqDone

    +

    XfrReqDone

    		 -

    +

    @@ -11313,10 +11450,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    UpdateReqFwd

    +

    UpdateReqFwd

    		 -

    +

    @@ -11326,10 +11463,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    UpdateRespFwd

    +

    UpdateRespFwd

    		 -

    +

    @@ -11339,10 +11476,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    UpdateFwdFail

    +

    UpdateFwdFail

    		 -

    +

    @@ -11352,10 +11489,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    UpdateDone

    +

    UpdateDone

    		 -

    +

    @@ -11365,10 +11502,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    UpdateFail

    +

    UpdateFail

    		 -

    +

    @@ -11378,10 +11515,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    UpdateBadPrereq

    +

    UpdateBadPrereq

    		 -

    +

    @@ -11391,10 +11528,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    RPZRewrites

    +

    RPZRewrites

    		 -

    +

    @@ -11404,10 +11541,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    RateDropped

    +

    RateDropped

    		 -

    +

    @@ -11417,10 +11554,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    RateSlipped

    +

    RateSlipped

    		 -

    +

    @@ -11431,13 +11568,13 @@ HOST-127.EXAMPLE. MX 0 .

    -
    +

    -Zone Maintenance Statistics Counters

    +Zone Maintenance Statistics Counters
    --++ @@ -11454,7 +11591,7 @@ HOST-127.EXAMPLE. MX 0 .
    -

    NotifyOutv4

    +

    NotifyOutv4

    @@ -11464,7 +11601,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    NotifyOutv6

    +

    NotifyOutv6

    @@ -11474,7 +11611,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    NotifyInv4

    +

    NotifyInv4

    @@ -11484,7 +11621,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    NotifyInv6

    +

    NotifyInv6

    @@ -11494,7 +11631,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    NotifyRej

    +

    NotifyRej

    @@ -11504,7 +11641,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    SOAOutv4

    +

    SOAOutv4

    @@ -11514,7 +11651,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    SOAOutv6

    +

    SOAOutv6

    @@ -11524,7 +11661,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    AXFRReqv4

    +

    AXFRReqv4

    @@ -11534,7 +11671,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    AXFRReqv6

    +

    AXFRReqv6

    @@ -11544,7 +11681,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    IXFRReqv4

    +

    IXFRReqv4

    @@ -11554,7 +11691,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    IXFRReqv6

    +

    IXFRReqv6

    @@ -11564,7 +11701,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    XfrSuccess

    +

    XfrSuccess

    @@ -11574,7 +11711,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    XfrFail

    +

    XfrFail

    @@ -11585,14 +11722,14 @@ HOST-127.EXAMPLE. MX 0 .

    -
    +

    -Resolver Statistics Counters

    +Resolver Statistics Counters
    ---+++ @@ -11614,10 +11751,10 @@ HOST-127.EXAMPLE. MX 0 .
    -

    Queryv4

    +

    Queryv4

    		 -

    SFwdQ

    +

    SFwdQ

    @@ -11627,10 +11764,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    Queryv6

    +

    Queryv6

    		 -

    SFwdQ

    +

    SFwdQ

    @@ -11640,10 +11777,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    Responsev4

    +

    Responsev4

    		 -

    RR

    +

    RR

    @@ -11653,10 +11790,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    Responsev6

    +

    Responsev6

    		 -

    RR

    +

    RR

    @@ -11666,10 +11803,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    NXDOMAIN

    +

    NXDOMAIN

    		 -

    RNXD

    +

    RNXD

    @@ -11679,10 +11816,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    SERVFAIL

    +

    SERVFAIL

    		 -

    RFail

    +

    RFail

    @@ -11692,10 +11829,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    FORMERR

    +

    FORMERR

    		 -

    RFErr

    +

    RFErr

    @@ -11705,10 +11842,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    OtherError

    +

    OtherError

    		 -

    RErr

    +

    RErr

    @@ -11718,10 +11855,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    EDNS0Fail

    +

    EDNS0Fail

    		 -

    +

    @@ -11731,10 +11868,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    Mismatch

    +

    Mismatch

    		 -

    RDupR

    +

    RDupR

    @@ -11743,7 +11880,7 @@ HOST-127.EXAMPLE. MX 0 . and/or the response's source port does not match what was expected. (The port must be 53 or as defined by - the port option.) + the port option.) This may be an indication of a cache poisoning attempt.

    @@ -11751,10 +11888,10 @@ HOST-127.EXAMPLE. MX 0 .
    -

    Truncated

    +

    Truncated

    		 -

    +

    @@ -11764,10 +11901,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    Lame

    +

    Lame

    		 -

    RLame

    +

    RLame

    @@ -11777,10 +11914,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    Retry

    +

    Retry

    		 -

    SDupQ

    +

    SDupQ

    @@ -11790,10 +11927,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    QueryAbort

    +

    QueryAbort

    		 -

    +

    @@ -11803,10 +11940,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    QuerySockFail

    +

    QuerySockFail

    		 -

    +

    @@ -11819,10 +11956,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    QueryTimeout

    +

    QueryTimeout

    		 -

    +

    @@ -11832,10 +11969,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    GlueFetchv4

    +

    GlueFetchv4

    		 -

    SSysQ

    +

    SSysQ

    @@ -11845,10 +11982,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    GlueFetchv6

    +

    GlueFetchv6

    		 -

    SSysQ

    +

    SSysQ

    @@ -11858,10 +11995,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    GlueFetchv4Fail

    +

    GlueFetchv4Fail

    		 -

    +

    @@ -11871,10 +12008,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    GlueFetchv6Fail

    +

    GlueFetchv6Fail

    		 -

    +

    @@ -11884,10 +12021,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    ValAttempt

    +

    ValAttempt

    		 -

    +

    @@ -11897,10 +12034,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    ValOk

    +

    ValOk

    		 -

    +

    @@ -11910,10 +12047,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    ValNegOk

    +

    ValNegOk

    		 -

    +

    @@ -11923,10 +12060,10 @@ HOST-127.EXAMPLE. MX 0 .

    -

    ValFail

    +

    ValFail

    		 -

    +

    @@ -11936,60 +12073,60 @@ HOST-127.EXAMPLE. MX 0 .

    -

    QryRTTnn

    +

    QryRTTnn

    		 -

    +

    Frequency table on round trip times (RTTs) of queries. - Each nn specifies the corresponding + Each nn specifies the corresponding frequency. In the sequence of - nn_1, - nn_2, + nn_1, + nn_2, ..., - nn_m, - the value of nn_i is the + nn_m, + the value of nn_i is the number of queries whose RTTs are between - nn_(i-1) (inclusive) and - nn_i (exclusive) milliseconds. + nn_(i-1) (inclusive) and + nn_i (exclusive) milliseconds. For the sake of convenience we define - nn_0 to be 0. + nn_0 to be 0. The last entry should be represented as - nn_m+, which means the + nn_m+, which means the number of queries whose RTTs are equal to or over - nn_m milliseconds. + nn_m milliseconds.

    -
    +

    -Socket I/O Statistics Counters

    +Socket I/O Statistics Counters

    Socket I/O statistics counters are defined per socket types, which are - UDP4 (UDP/IPv4), - UDP6 (UDP/IPv6), - TCP4 (TCP/IPv4), - TCP6 (TCP/IPv6), - Unix (Unix Domain), and - FDwatch (sockets opened outside the + UDP4 (UDP/IPv4), + UDP6 (UDP/IPv6), + TCP4 (TCP/IPv4), + TCP6 (TCP/IPv6), + Unix (Unix Domain), and + FDwatch (sockets opened outside the socket module). - In the following table <TYPE> + In the following table <TYPE> represents a socket type. Not all counters are available for all socket types; exceptions are noted in the description field.

    --++ @@ -12006,31 +12143,31 @@ HOST-127.EXAMPLE. MX 0 .
    -

    <TYPE>Open

    +

    <TYPE>Open

    Sockets opened successfully. This counter is not applicable to the - FDwatch type. + FDwatch type.

    -

    <TYPE>OpenFail

    +

    <TYPE>OpenFail

    Failures of opening sockets. This counter is not applicable to the - FDwatch type. + FDwatch type.

    -

    <TYPE>Close

    +

    <TYPE>Close

    @@ -12040,7 +12177,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    <TYPE>BindFail

    +

    <TYPE>BindFail

    @@ -12050,7 +12187,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    <TYPE>ConnFail

    +

    <TYPE>ConnFail

    @@ -12060,7 +12197,7 @@ HOST-127.EXAMPLE. MX 0 .

    -

    <TYPE>Conn

    +

    <TYPE>Conn

    @@ -12070,46 +12207,46 @@ HOST-127.EXAMPLE. MX 0 .

    -

    <TYPE>AcceptFail

    +

    <TYPE>AcceptFail

    Failures of accepting incoming connection requests. This counter is not applicable to the - UDP and - FDwatch types. + UDP and + FDwatch types.

    -

    <TYPE>Accept

    +

    <TYPE>Accept

    Incoming connections successfully accepted. This counter is not applicable to the - UDP and - FDwatch types. + UDP and + FDwatch types.

    -

    <TYPE>SendErr

    +

    <TYPE>SendErr

    Errors in socket send operations. This counter corresponds - to SErr counter of - BIND 8. + to SErr counter of + BIND 8.

    -

    <TYPE>RecvErr

    +

    <TYPE>RecvErr

    @@ -12123,36 +12260,36 @@ HOST-127.EXAMPLE. MX 0 .

    -
    +

    -Compatibility with BIND 8 Counters

    +Compatibility with BIND 8 Counters

    Most statistics counters that were available - in BIND 8 are also supported in - BIND 9 as shown in the above tables. + in BIND 8 are also supported in + BIND 9 as shown in the above tables. Here are notes about other counters that do not appear in these tables.

    -
    -
    RFwdR,SFwdR
    +
    +
    RFwdR,SFwdR

    These counters are not supported - because BIND 9 does not adopt + because BIND 9 does not adopt the notion of forwarding - as BIND 8 did. + as BIND 8 did.

    -
    RAXFR
    +
    RAXFR

    This counter is accessible in the Incoming Queries section.

    -
    RIQ
    +
    RIQ

    This counter is accessible in the Incoming Requests section.

    -
    ROpts
    +
    ROpts

    This counter is not supported - because BIND 9 does not care + because BIND 9 does not care about IP options in the first place.

    @@ -12177,6 +12314,6 @@ HOST-127.EXAMPLE. MX 0 .
    -

    BIND 9.9.8-P4 (Extended Support Version)

    +

    BIND 9.9.9-P3 (Extended Support Version)

    diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch07.html b/contrib/bind9/doc/arm/Bv9ARM.ch07.html index bdfca5116..95aa52f2f 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch07.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch07.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Chapter 7. BIND 9 Security Considerations - - + + @@ -39,30 +38,30 @@
    -
    -

    -Chapter 7. BIND 9 Security Considerations

    +
    +

    +Chapter 7. BIND 9 Security Considerations

    Table of Contents

    -
    -
    Access Control Lists
    -
    Chroot and Setuid
    +
    +
    Access Control Lists
    +
    Chroot and Setuid
    -
    The chroot Environment
    -
    Using the setuid Function
    +
    The chroot Environment
    +
    Using the setuid Function
    -
    Dynamic Update Security
    +
    Dynamic Update Security
    -
    +

    Access Control Lists

    Access Control Lists (ACLs) are address match lists that - you can set up and nickname for future use in allow-notify, - allow-query, allow-query-on, - allow-recursion, allow-recursion-on, - blackhole, allow-transfer, + you can set up and nickname for future use in allow-notify, + allow-query, allow-query-on, + allow-recursion, allow-recursion-on, + blackhole, allow-transfer, etc.

    @@ -112,15 +111,15 @@ zone "example.com" { unless recursion has been previously disabled.

    -
    +

    -Chroot and Setuid +Chroot and Setuid

    On UNIX servers, it is possible to run BIND in a chrooted environment (using - the chroot() function) by specifying - the "-t" option for named. + the chroot() function) by specifying + the "-t" option for named. This can help improve system security by placing BIND in a "sandbox", which will limit the damage done if a server is compromised. @@ -128,21 +127,21 @@ zone "example.com" {

    Another useful feature in the UNIX version of BIND is the ability to run the daemon as an unprivileged user ( -u user ). - We suggest running as an unprivileged user when using the chroot feature. + We suggest running as an unprivileged user when using the chroot feature.

    - Here is an example command line to load BIND in a chroot sandbox, - /var/named, and to run named setuid to + Here is an example command line to load BIND in a chroot sandbox, + /var/named, and to run named setuid to user 202:

    /usr/local/sbin/named -u 202 -t /var/named

    -
    +

    -The chroot Environment

    +The chroot Environment

    - In order for a chroot environment + In order for a chroot environment to work properly in a particular directory (for example, /var/named), @@ -151,12 +150,12 @@ zone "example.com" { From BIND's point of view, /var/named is the root of the filesystem. You will need to adjust the values of options like - like directory and pid-file to account + like directory and pid-file to account for this.

    Unlike with earlier versions of BIND, you typically will - not need to compile named + not need to compile named statically nor install shared libraries under the new root. However, depending on your operating system, you may need to set up things like @@ -166,15 +165,15 @@ zone "example.com" { /etc/localtime.

    -
    +

    -Using the setuid Function

    +Using the setuid Function

    - Prior to running the named daemon, + Prior to running the named daemon, use - the touch utility (to change file + the touch utility (to change file access and - modification times) or the chown + modification times) or the chown utility (to set the user id and/or group id) on files to which you want BIND @@ -182,13 +181,15 @@ zone "example.com" {

    Note

    - Note that if the named daemon is running as an +

    + If the named daemon is running as an unprivileged user, it will not be able to bind to new restricted ports if the server is reloaded. -

    +

    +
    -
    +

    Dynamic Update Security

    @@ -198,12 +199,12 @@ zone "example.com" { based on the IP address of the host requesting the update, by listing an IP address or - network prefix in the allow-update + network prefix in the allow-update zone option. This method is insecure since the source address of the update UDP packet is easily forged. Also note that if the IP addresses allowed by the - allow-update option include the + allow-update option include the address of a slave server which performs forwarding of dynamic updates, the master can be @@ -214,10 +215,10 @@ zone "example.com" {

    For these reasons, we strongly recommend that updates be cryptographically authenticated by means of transaction signatures - (TSIG). That is, the allow-update + (TSIG). That is, the allow-update option should list only TSIG key names, not IP addresses or network - prefixes. Alternatively, the new update-policy + prefixes. Alternatively, the new update-policy option can be used.

    @@ -247,6 +248,6 @@ zone "example.com" {

    -

    BIND 9.9.8-P4 (Extended Support Version)

    +

    BIND 9.9.9-P3 (Extended Support Version)

    diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch08.html b/contrib/bind9/doc/arm/Bv9ARM.ch08.html index 8a25488b2..4120cfc42 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch08.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch08.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Chapter 8. Troubleshooting - - + + @@ -39,24 +38,24 @@
    -
    -

    -Chapter 8. Troubleshooting

    +
    +

    +Chapter 8. Troubleshooting

    Table of Contents

    -
    -
    Common Problems
    -
    It's not working; how can I figure out what's wrong?
    -
    Incrementing and Changing the Serial Number
    -
    Where Can I Get Help?
    +
    +
    Common Problems
    +
    It's not working; how can I figure out what's wrong?
    +
    Incrementing and Changing the Serial Number
    +
    Where Can I Get Help?
    -
    +

    -Common Problems

    -
    +Common Problems
    +

    -It's not working; how can I figure out what's wrong?

    +It's not working; how can I figure out what's wrong?

    The best solution to solving installation and configuration issues is to take preventative measures by setting @@ -66,9 +65,9 @@

    -
    +

    -Incrementing and Changing the Serial Number

    +Incrementing and Changing the Serial Number

    Zone serial numbers are just numbers — they aren't date related. A lot of people set them to a number that @@ -93,9 +92,9 @@ it to be, and reload the zone again.

    -
    +

    -Where Can I Get Help?

    +Where Can I Get Help?

    The Internet Systems Consortium (ISC) offers a wide range @@ -111,9 +110,9 @@

    To discuss arrangements for support, contact - info@isc.org or visit the + info@isc.org or visit the ISC web page at - http://www.isc.org/services/support/ + http://www.isc.org/services/support/ to read more.

@@ -135,6 +134,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch09.html b/contrib/bind9/doc/arm/Bv9ARM.ch09.html index 706fb8b60..08d15df68 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch09.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch09.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Appendix A. Release Notes - - + + @@ -39,136 +38,130 @@
-
-

-Appendix A. Release Notes

+
+

+Release Notes

Table of Contents

-
-
Release Notes for BIND Version 9.9.8-P4
+
+
Release Notes for BIND Version 9.9.9-P3
-
Introduction
-
Download
-
Security Fixes
-
New Features
-
Feature Changes
-
Bug Fixes
-
End of Life
-
Thank You
+
Introduction
+
Download
+
Security Fixes
+
New Features
+
Feature Changes
+
Porting Changes
+
Bug Fixes
+
End of Life
+
Thank You
-
+

-Release Notes for BIND Version 9.9.8-P4

-
+Release Notes for BIND Version 9.9.9-P3
+

Introduction

- This document summarizes changes since BIND 9.9.8: + This document summarizes changes since BIND 9.9.9:

- BIND 9.9.8-P4 addresses the security issues described in - CVE-2016-1285 and CVE-2016-1286. + BIND 9.10.9-P3 addresses the security issue described in + CVE-2016-2776.

- BIND 9.9.8-P3 addresses the security issue described in CVE-2015-8704. - It also fixes a serious regression in authoritative server selection - that was introduced in 9.9.8. + BIND 9.9.9-P2 addresses the security issue described in + CVE-2016-2775.

- BIND 9.9.8-P2 addresses security issues described in CVE-2015-3193 - (OpenSSL), CVE-2015-8000 and CVE-2015-8461. -

-

- BIND 9.9.8-P1 was incomplete and was withdrawn prior to publication. + BIND 9.9.9-P1 addresses Windows installation issues and a race + condition in the rbt/rbtdb implementation resulting in named + exiting due to assertion failures being detected.

-
+

Download

The latest versions of BIND 9 software can always be found at - http://www.isc.org/downloads/. + http://www.isc.org/downloads/. There you will find additional information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems.

-
+

Security Fixes

-
    -

  • - The resolver could abort with an assertion failure due to - improper DNAME handling when parsing fetch reply - messages. This flaw is disclosed in CVE-2016-1286. [RT #41753] -

    • -

  • - Malformed control messages can trigger assertions in named - and rndc. This flaw is disclosed in CVE-2016-1285. [RT - #41666] -

    • -

  • - Specific APL data could trigger an INSIST. This flaw - is disclosed in CVE-2015-8704. [RT #41396] +

      +

    • + It was possible to trigger a assertion when rendering a + message using a specially crafted request. This flaw is + disclosed in CVE-2016-2776. [RT #43139]

      • -

    • - Named is potentially vulnerable to the OpenSSL vulnerability - described in CVE-2015-3193. -

      • -

    • - Incorrect reference counting could result in an INSIST - failure if a socket error occurred while performing a - lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945] -

      • -

    • - Insufficient testing when parsing a message allowed - records with an incorrect class to be be accepted, - triggering a REQUIRE failure when those records - were subsequently cached. This flaw is disclosed - in CVE-2015-8000. [RT #40987] +

    • + getrrsetbyname with a non absolute name could trigger an + infinite recursion bug in lwresd and named with lwres + configured if when combined with a search list entry the + resulting name is too long. This flaw is disclosed in + CVE-2016-2775. [RT #42694]

-
+

New Features

-

  • None

+

  • + None. +

-
+

Feature Changes

-

  • - Updated the compiled in addresses for H.ROOT-SERVERS.NET. +

    • + None.

-
+

-Bug Fixes

-

  • - Authoritative servers that were marked as bogus (e.g. blackholed - in configuration or with invalid addresses) were being queried - anyway. [RT #41321] +Porting Changes

+

  • + None.

-
+
+

+Bug Fixes

+
    +

  • + Windows installs were failing due to triggering UAC without + the installation binary being signed. +

    • +

  • + A race condition in rbt/rbtdb was leading to INSISTs being + triggered. +

    • +
+
+

End of Life

- The BIND 9.9 (Extended Support Version) will be supported until + BIND 9.9 (Extended Support Version) will be supported until December, 2017. - https://www.isc.org/downloads/software-support-policy/ + https://www.isc.org/downloads/software-support-policy/

-
+

Thank You

Thank you to everyone who assisted us in making this release possible. If you would like to contribute to ISC to assist us in continuing to make quality open source software, please visit our donations page at - http://www.isc.org/donate/. + http://www.isc.org/donate/.

@@ -191,6 +184,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch10.html b/contrib/bind9/doc/arm/Bv9ARM.ch10.html index 763d446cd..e2c60355c 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch10.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch10.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Appendix B. A Brief History of the DNS and BIND - - + + @@ -40,111 +39,104 @@
-
-

-Appendix B. A Brief History of the DNS and BIND -

-
-

Table of Contents

-
-
-
-
-

- Although the "official" beginning of the Domain Name - System occurred in 1984 with the publication of RFC 920, the - core of the new system was described in 1983 in RFCs 882 and - 883. From 1984 to 1987, the ARPAnet (the precursor to today's - Internet) became a testbed of experimentation for developing the - new naming/addressing scheme in a rapidly expanding, - operational network environment. New RFCs were written and - published in 1987 that modified the original documents to - incorporate improvements based on the working model. RFC 1034, - "Domain Names-Concepts and Facilities", and RFC 1035, "Domain - Names-Implementation and Specification" were published and - became the standards upon which all DNS implementations are - built. -

+
+

+A Brief History of the DNS and BIND +

+

+ Although the "official" beginning of the Domain Name + System occurred in 1984 with the publication of RFC 920, the + core of the new system was described in 1983 in RFCs 882 and + 883. From 1984 to 1987, the ARPAnet (the precursor to today's + Internet) became a testbed of experimentation for developing the + new naming/addressing scheme in a rapidly expanding, + operational network environment. New RFCs were written and + published in 1987 that modified the original documents to + incorporate improvements based on the working model. RFC 1034, + "Domain Names-Concepts and Facilities", and RFC 1035, "Domain + Names-Implementation and Specification" were published and + became the standards upon which all DNS implementations are + built. +

- The first working domain name server, called "Jeeves", was - written in 1983-84 by Paul Mockapetris for operation on DEC - Tops-20 - machines located at the University of Southern California's - Information - Sciences Institute (USC-ISI) and SRI International's Network - Information - Center (SRI-NIC). A DNS server for - Unix machines, the Berkeley Internet - Name Domain (BIND) package, was - written soon after by a group of - graduate students at the University of California at Berkeley - under - a grant from the US Defense Advanced Research Projects - Administration - (DARPA). -

+ The first working domain name server, called "Jeeves", was + written in 1983-84 by Paul Mockapetris for operation on DEC + Tops-20 + machines located at the University of Southern California's + Information + Sciences Institute (USC-ISI) and SRI International's Network + Information + Center (SRI-NIC). A DNS server for + Unix machines, the Berkeley Internet + Name Domain (BIND) package, was + written soon after by a group of + graduate students at the University of California at Berkeley + under + a grant from the US Defense Advanced Research Projects + Administration + (DARPA). +

- Versions of BIND through - 4.8.3 were maintained by the Computer - Systems Research Group (CSRG) at UC Berkeley. Douglas Terry, Mark - Painter, David Riggle and Songnian Zhou made up the initial BIND - project team. After that, additional work on the software package - was done by Ralph Campbell. Kevin Dunlap, a Digital Equipment - Corporation - employee on loan to the CSRG, worked on BIND for 2 years, from 1985 - to 1987. Many other people also contributed to BIND development - during that time: Doug Kingston, Craig Partridge, Smoot - Carl-Mitchell, - Mike Muuss, Jim Bloom and Mike Schwartz. BIND maintenance was subsequently - handled by Mike Karels and Øivind Kure. -

+ Versions of BIND through + 4.8.3 were maintained by the Computer + Systems Research Group (CSRG) at UC Berkeley. Douglas Terry, Mark + Painter, David Riggle and Songnian Zhou made up the initial BIND + project team. After that, additional work on the software package + was done by Ralph Campbell. Kevin Dunlap, a Digital Equipment + Corporation + employee on loan to the CSRG, worked on BIND for 2 years, from 1985 + to 1987. Many other people also contributed to BIND development + during that time: Doug Kingston, Craig Partridge, Smoot + Carl-Mitchell, + Mike Muuss, Jim Bloom and Mike Schwartz. BIND maintenance was subsequently + handled by Mike Karels and Øivind Kure. +

- BIND versions 4.9 and 4.9.1 were - released by Digital Equipment - Corporation (now Compaq Computer Corporation). Paul Vixie, then - a DEC employee, became BIND's - primary caretaker. He was assisted - by Phil Almquist, Robert Elz, Alan Barrett, Paul Albitz, Bryan - Beecher, Andrew - Partan, Andy Cherenson, Tom Limoncelli, Berthold Paffrath, Fuat - Baran, Anant Kumar, Art Harkin, Win Treese, Don Lewis, Christophe - Wolfhugel, and others. -

+ BIND versions 4.9 and 4.9.1 were + released by Digital Equipment + Corporation (now Compaq Computer Corporation). Paul Vixie, then + a DEC employee, became BIND's + primary caretaker. He was assisted + by Phil Almquist, Robert Elz, Alan Barrett, Paul Albitz, Bryan + Beecher, Andrew + Partan, Andy Cherenson, Tom Limoncelli, Berthold Paffrath, Fuat + Baran, Anant Kumar, Art Harkin, Win Treese, Don Lewis, Christophe + Wolfhugel, and others. +

- In 1994, BIND version 4.9.2 was sponsored by - Vixie Enterprises. Paul - Vixie became BIND's principal - architect/programmer. -

+ In 1994, BIND version 4.9.2 was sponsored by + Vixie Enterprises. Paul + Vixie became BIND's principal + architect/programmer. +

- BIND versions from 4.9.3 onward - have been developed and maintained - by the Internet Systems Consortium and its predecessor, - the Internet Software Consortium, with support being provided - by ISC's sponsors. -

+ BIND versions from 4.9.3 onward + have been developed and maintained + by the Internet Systems Consortium and its predecessor, + the Internet Software Consortium, with support being provided + by ISC's sponsors. +

- As co-architects/programmers, Bob Halley and - Paul Vixie released the first production-ready version of - BIND version 8 in May 1997. -

+ As co-architects/programmers, Bob Halley and + Paul Vixie released the first production-ready version of + BIND version 8 in May 1997. +

- BIND version 9 was released in September 2000 and is a - major rewrite of nearly all aspects of the underlying - BIND architecture. -

+ BIND version 9 was released in September 2000 and is a + major rewrite of nearly all aspects of the underlying + BIND architecture. +

- BIND versions 4 and 8 are officially deprecated. - No additional development is done - on BIND version 4 or BIND version 8. -

+ BIND versions 4 and 8 are officially deprecated. + No additional development is done + on BIND version 4 or BIND version 8. +

- BIND development work is made - possible today by the sponsorship - of several corporations, and by the tireless work efforts of - numerous individuals. -

-
+ BIND development work is made + possible today by the sponsorship + of several corporations, and by the tireless work efforts of + numerous individuals. +

@@ -163,6 +155,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch11.html b/contrib/bind9/doc/arm/Bv9ARM.ch11.html index 207760ace..c842b29f6 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch11.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch11.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Appendix C. General DNS Reference Information - - + + @@ -39,22 +38,22 @@
-
-

-Appendix C. General DNS Reference Information

+
+

+General DNS Reference Information

Table of Contents

-
-
IPv6 addresses (AAAA)
-
Bibliography (and Suggested Reading)
+
+
IPv6 addresses (AAAA)
+
Bibliography (and Suggested Reading)
-
Request for Comments (RFCs)
-
Internet Drafts
-
Other Documents About BIND
+
Request for Comments (RFCs)
+
Internet Drafts
+
Other Documents About BIND
-
+

IPv6 addresses (AAAA)

@@ -101,7 +100,7 @@ implementation, although it is usually possible to override the default setting if necessary. A typical IPv6 address might look like: - 2001:db8:201:9:a00:20ff:fe81:2b32 + 2001:db8:201:9:a00:20ff:fe81:2b32

IPv6 address specifications often contain long strings @@ -112,10 +111,10 @@ of zeros that can fit, and can be used only once in an address.

-
+

Bibliography (and Suggested Reading)

-
+

Request for Comments (RFCs)

@@ -127,7 +126,7 @@ Engineering Steering Group (IESG). RFCs can be obtained online via FTP at:

- + ftp://www.isi.edu/in-notes/RFCxxxx.txt

@@ -136,238 +135,224 @@ the number of the RFC). RFCs are also available via the Web at:

- http://www.ietf.org/rfc/. + http://www.ietf.org/rfc/.

-Bibliography

+Bibliography
-

Standards

-

[RFC974] C. Partridge. Mail Routing and the Domain System. January 1986.

+

[RFC974] C. Partridge. Mail Routing and the Domain System. January 1986.

-

[RFC1034] P.V. Mockapetris. Domain Names — Concepts and Facilities. November 1987.

+

[RFC1034] P.V. Mockapetris. Domain Names — Concepts and Facilities. November 1987.

-

[RFC1035] P. V. Mockapetris. Domain Names — Implementation and - Specification. November 1987.

+

[RFC1035] P. V. Mockapetris. Domain Names — Implementation and + Specification. November 1987.

-

-Proposed Standards

-

[RFC2181] R., R. Bush Elz. Clarifications to the DNS - Specification. July 1997.

+

[RFC2181] R., R. Bush Elz. Clarifications to the DNS + Specification. July 1997.

-

[RFC2308] M. Andrews. Negative Caching of DNS - Queries. March 1998.

+

[RFC2308] M. Andrews. Negative Caching of DNS + Queries. March 1998.

-

[RFC1995] M. Ohta. Incremental Zone Transfer in DNS. August 1996.

+

[RFC1995] M. Ohta. Incremental Zone Transfer in DNS. August 1996.

-

[RFC1996] P. Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996.

+

[RFC1996] P. Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996.

-

[RFC2136] P. Vixie, S. Thomson, Y. Rekhter, and J. Bound. Dynamic Updates in the Domain Name System. April 1997.

+

[RFC2136] P. Vixie, S. Thomson, Y. Rekhter, and J. Bound. Dynamic Updates in the Domain Name System. April 1997.

-

[RFC2671] P. Vixie. Extension Mechanisms for DNS (EDNS0). August 1997.

+

[RFC2671] P. Vixie. Extension Mechanisms for DNS (EDNS0). August 1997.

-

[RFC2672] M. Crawford. Non-Terminal DNS Name Redirection. August 1999.

+

[RFC2672] M. Crawford. Non-Terminal DNS Name Redirection. August 1999.

-

[RFC2845] P. Vixie, O. Gudmundsson, D. Eastlake, 3rd, and B. Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000.

+

[RFC2845] P. Vixie, O. Gudmundsson, D. Eastlake, 3rd, and B. Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000.

-

[RFC2930] D. Eastlake, 3rd. Secret Key Establishment for DNS (TKEY RR). September 2000.

+

[RFC2930] D. Eastlake, 3rd. Secret Key Establishment for DNS (TKEY RR). September 2000.

-

[RFC2931] D. Eastlake, 3rd. DNS Request and Transaction Signatures (SIG(0)s). September 2000.

+

[RFC2931] D. Eastlake, 3rd. DNS Request and Transaction Signatures (SIG(0)s). September 2000.

-

[RFC3007] B. Wellington. Secure Domain Name System (DNS) Dynamic Update. November 2000.

+

[RFC3007] B. Wellington. Secure Domain Name System (DNS) Dynamic Update. November 2000.

-

[RFC3645] S. Kwan, P. Garg, J. Gilroy, L. Esibov, J. Westhead, and R. Hall. Generic Security Service Algorithm for Secret +

[RFC3645] S. Kwan, P. Garg, J. Gilroy, L. Esibov, J. Westhead, and R. Hall. Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS - (GSS-TSIG). October 2003.

+ (GSS-TSIG). October 2003.

-

-DNS Security Proposed Standards

-

[RFC3225] D. Conrad. Indicating Resolver Support of DNSSEC. December 2001.

+

[RFC3225] D. Conrad. Indicating Resolver Support of DNSSEC. December 2001.

-

[RFC3833] D. Atkins and R. Austein. Threat Analysis of the Domain Name System (DNS). August 2004.

+

[RFC3833] D. Atkins and R. Austein. Threat Analysis of the Domain Name System (DNS). August 2004.

-

[RFC4033] R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. DNS Security Introduction and Requirements. March 2005.

+

[RFC4033] R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. DNS Security Introduction and Requirements. March 2005.

-

[RFC4034] R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. Resource Records for the DNS Security Extensions. March 2005.

+

[RFC4034] R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. Resource Records for the DNS Security Extensions. March 2005.

-

[RFC4035] R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. Protocol Modifications for the DNS - Security Extensions. March 2005.

+

[RFC4035] R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. Protocol Modifications for the DNS + Security Extensions. March 2005.

-

Other Important RFCs About DNS - Implementation

-

[RFC1535] E. Gavron. A Security Problem and Proposed Correction With Widely - Deployed DNS Software.. October 1993.

+

[RFC1535] E. Gavron. A Security Problem and Proposed Correction With Widely + Deployed DNS Software.. October 1993.

-

[RFC1536] A. Kumar, J. Postel, C. Neuman, P. Danzig, and S. Miller. Common DNS Implementation - Errors and Suggested Fixes. October 1993.

+

[RFC1536] A. Kumar, J. Postel, C. Neuman, P. Danzig, and S. Miller. Common DNS Implementation + Errors and Suggested Fixes. October 1993.

-

[RFC1982] R. Elz and R. Bush. Serial Number Arithmetic. August 1996.

+

[RFC1982] R. Elz and R. Bush. Serial Number Arithmetic. August 1996.

-

[RFC4074] Y. Morishita and T. Jinmei. Common Misbehaviour Against DNS - Queries for IPv6 Addresses. May 2005.

+

[RFC4074] Y. Morishita and T. Jinmei. Common Misbehaviour Against DNS + Queries for IPv6 Addresses. May 2005.

-

Resource Record Types

-

[RFC1183] C.F. Everhart, L. A. Mamakos, R. Ullmann, and P. Mockapetris. New DNS RR Definitions. October 1990.

+

[RFC1183] C.F. Everhart, L. A. Mamakos, R. Ullmann, and P. Mockapetris. New DNS RR Definitions. October 1990.

-

[RFC1706] B. Manning and R. Colella. DNS NSAP Resource Records. October 1994.

+

[RFC1706] B. Manning and R. Colella. DNS NSAP Resource Records. October 1994.

-

[RFC2168] R. Daniel and M. Mealling. Resolution of Uniform Resource Identifiers using - the Domain Name System. June 1997.

+

[RFC2168] R. Daniel and M. Mealling. Resolution of Uniform Resource Identifiers using + the Domain Name System. June 1997.

-

[RFC1876] C. Davis, P. Vixie, T., and I. Dickinson. A Means for Expressing Location Information in the +

[RFC1876] C. Davis, P. Vixie, T., and I. Dickinson. A Means for Expressing Location Information in the Domain - Name System. January 1996.

+ Name System. January 1996.

-

[RFC2052] A. Gulbrandsen and P. Vixie. A DNS RR for Specifying the +

[RFC2052] A. Gulbrandsen and P. Vixie. A DNS RR for Specifying the Location of - Services.. October 1996.

+ Services.. October 1996.

-

[RFC2163] A. Allocchio. Using the Internet DNS to +

[RFC2163] A. Allocchio. Using the Internet DNS to Distribute MIXER - Conformant Global Address Mapping. January 1998.

+ Conformant Global Address Mapping. January 1998.

-

[RFC2230] R. Atkinson. Key Exchange Delegation Record for the DNS. October 1997.

+

[RFC2230] R. Atkinson. Key Exchange Delegation Record for the DNS. October 1997.

-

[RFC2536] D. Eastlake, 3rd. DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.

+

[RFC2536] D. Eastlake, 3rd. DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.

-

[RFC2537] D. Eastlake, 3rd. RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.

+

[RFC2537] D. Eastlake, 3rd. RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.

-

[RFC2538] D. Eastlake, 3rd and O. Gudmundsson. Storing Certificates in the Domain Name System (DNS). March 1999.

+

[RFC2538] D. Eastlake, 3rd and O. Gudmundsson. Storing Certificates in the Domain Name System (DNS). March 1999.

-

[RFC2539] D. Eastlake, 3rd. Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.

+

[RFC2539] D. Eastlake, 3rd. Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.

-

[RFC2540] D. Eastlake, 3rd. Detached Domain Name System (DNS) Information. March 1999.

+

[RFC2540] D. Eastlake, 3rd. Detached Domain Name System (DNS) Information. March 1999.

-

[RFC2782] A. Gulbrandsen. P. Vixie. L. Esibov. A DNS RR for specifying the location of services (DNS SRV). February 2000.

+

[RFC2782] A. Gulbrandsen. P. Vixie. L. Esibov. A DNS RR for specifying the location of services (DNS SRV). February 2000.

-

[RFC2915] M. Mealling. R. Daniel. The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.

+

[RFC2915] M. Mealling. R. Daniel. The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.

-

[RFC3110] D. Eastlake, 3rd. RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.

+

[RFC3110] D. Eastlake, 3rd. RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.

-

[RFC3123] P. Koch. A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.

+

[RFC3123] P. Koch. A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.

-

[RFC3596] S. Thomson, C. Huitema, V. Ksinant, and M. Souissi. DNS Extensions to support IP - version 6. October 2003.

+

[RFC3596] S. Thomson, C. Huitema, V. Ksinant, and M. Souissi. DNS Extensions to support IP + version 6. October 2003.

-

[RFC3597] A. Gustafsson. Handling of Unknown DNS Resource Record (RR) Types. September 2003.

+

[RFC3597] A. Gustafsson. Handling of Unknown DNS Resource Record (RR) Types. September 2003.

-

-DNS and the Internet

-

[RFC1101] P. V. Mockapetris. DNS Encoding of Network Names - and Other Types. April 1989.

+

[RFC1101] P. V. Mockapetris. DNS Encoding of Network Names + and Other Types. April 1989.

-

[RFC1123] Braden. Requirements for Internet Hosts - Application and - Support. October 1989.

+

[RFC1123] Braden. Requirements for Internet Hosts - Application and + Support. October 1989.

-

[RFC1591] J. Postel. Domain Name System Structure and Delegation. March 1994.

+

[RFC1591] J. Postel. Domain Name System Structure and Delegation. March 1994.

-

[RFC2317] H. Eidnes, G. de Groot, and P. Vixie. Classless IN-ADDR.ARPA Delegation. March 1998.

+

[RFC2317] H. Eidnes, G. de Groot, and P. Vixie. Classless IN-ADDR.ARPA Delegation. March 1998.

-

[RFC2826] Internet Architecture Board. IAB Technical Comment on the Unique DNS Root. May 2000.

+

[RFC2826] Internet Architecture Board. IAB Technical Comment on the Unique DNS Root. May 2000.

-

[RFC2929] D. Eastlake, 3rd, E. Brunner-Williams, and B. Manning. Domain Name System (DNS) IANA Considerations. September 2000.

+

[RFC2929] D. Eastlake, 3rd, E. Brunner-Williams, and B. Manning. Domain Name System (DNS) IANA Considerations. September 2000.

-

-DNS Operations

-

[RFC1033] M. Lottor. Domain administrators operations guide.. November 1987.

+

[RFC1033] M. Lottor. Domain administrators operations guide.. November 1987.

-

[RFC1537] P. Beertema. Common DNS Data File - Configuration Errors. October 1993.

+

[RFC1537] P. Beertema. Common DNS Data File + Configuration Errors. October 1993.

-

[RFC1912] D. Barr. Common DNS Operational and - Configuration Errors. February 1996.

+

[RFC1912] D. Barr. Common DNS Operational and + Configuration Errors. February 1996.

-

[RFC2010] B. Manning and P. Vixie. Operational Criteria for Root Name Servers.. October 1996.

+

[RFC2010] B. Manning and P. Vixie. Operational Criteria for Root Name Servers.. October 1996.

-

[RFC2219] M. Hamilton and R. Wright. Use of DNS Aliases for - Network Services.. October 1997.

+

[RFC2219] M. Hamilton and R. Wright. Use of DNS Aliases for + Network Services.. October 1997.

-

Internationalized Domain Names

-

[RFC2825] IAB and R. Daigle. A Tangled Web: Issues of I18N, Domain Names, - and the Other Internet protocols. May 2000.

+

[RFC2825] IAB and R. Daigle. A Tangled Web: Issues of I18N, Domain Names, + and the Other Internet protocols. May 2000.

-

[RFC3490] P. Faltstrom, P. Hoffman, and A. Costello. Internationalizing Domain Names in Applications (IDNA). March 2003.

+

[RFC3490] P. Faltstrom, P. Hoffman, and A. Costello. Internationalizing Domain Names in Applications (IDNA). March 2003.

-

[RFC3491] P. Hoffman and M. Blanchet. Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003.

+

[RFC3491] P. Hoffman and M. Blanchet. Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003.

-

[RFC3492] A. Costello. Punycode: A Bootstring encoding of Unicode +

[RFC3492] A. Costello. Punycode: A Bootstring encoding of Unicode for Internationalized Domain Names in - Applications (IDNA). March 2003.

+ Applications (IDNA). March 2003.

-

Other DNS-related RFCs

Note

@@ -377,52 +362,50 @@

-

[RFC1464] R. Rosenbaum. Using the Domain Name System To Store Arbitrary String - Attributes. May 1993.

+

[RFC1464] R. Rosenbaum. Using the Domain Name System To Store Arbitrary String + Attributes. May 1993.

-

[RFC1713] A. Romao. Tools for DNS Debugging. November 1994.

+

[RFC1713] A. Romao. Tools for DNS Debugging. November 1994.

-

[RFC1794] T. Brisco. DNS Support for Load - Balancing. April 1995.

+

[RFC1794] T. Brisco. DNS Support for Load + Balancing. April 1995.

-

[RFC2240] O. Vaughan. A Legal Basis for Domain Name Allocation. November 1997.

+

[RFC2240] O. Vaughan. A Legal Basis for Domain Name Allocation. November 1997.

-

[RFC2345] J. Klensin, T. Wolf, and G. Oglesby. Domain Names and Company Name Retrieval. May 1998.

+

[RFC2345] J. Klensin, T. Wolf, and G. Oglesby. Domain Names and Company Name Retrieval. May 1998.

-

[RFC2352] O. Vaughan. A Convention For Using Legal Names as Domain Names. May 1998.

+

[RFC2352] O. Vaughan. A Convention For Using Legal Names as Domain Names. May 1998.

-

[RFC3071] J. Klensin. Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.

+

[RFC3071] J. Klensin. Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.

-

[RFC3258] T. Hardie. Distributing Authoritative Name Servers via - Shared Unicast Addresses. April 2002.

+

[RFC3258] T. Hardie. Distributing Authoritative Name Servers via + Shared Unicast Addresses. April 2002.

-

[RFC3901] A. Durand and J. Ihren. DNS IPv6 Transport Operational Guidelines. September 2004.

+

[RFC3901] A. Durand and J. Ihren. DNS IPv6 Transport Operational Guidelines. September 2004.

-

Obsolete and Unimplemented Experimental RFC

-

[RFC1712] C. Farrell, M. Schulze, S. Pleitner, and D. Baldoni. DNS Encoding of Geographical - Location. November 1994.

+

[RFC1712] C. Farrell, M. Schulze, S. Pleitner, and D. Baldoni. DNS Encoding of Geographical + Location. November 1994.

-

[RFC2673] M. Crawford. Binary Labels in the Domain Name System. August 1999.

+

[RFC2673] M. Crawford. Binary Labels in the Domain Name System. August 1999.

-

[RFC2874] M. Crawford and C. Huitema. DNS Extensions to Support IPv6 Address Aggregation - and Renumbering. July 2000.

+

[RFC2874] M. Crawford and C. Huitema. DNS Extensions to Support IPv6 Address Aggregation + and Renumbering. July 2000.

-

Obsoleted DNS Security RFCs

Note

@@ -431,44 +414,44 @@

-

[RFC2065] D. Eastlake, 3rd and C. Kaufman. Domain Name System Security Extensions. January 1997.

+

[RFC2065] D. Eastlake, 3rd and C. Kaufman. Domain Name System Security Extensions. January 1997.

-

[RFC2137] D. Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997.

+

[RFC2137] D. Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997.

-

[RFC2535] D. Eastlake, 3rd. Domain Name System Security Extensions. March 1999.

+

[RFC2535] D. Eastlake, 3rd. Domain Name System Security Extensions. March 1999.

-

[RFC3008] B. Wellington. Domain Name System Security (DNSSEC) - Signing Authority. November 2000.

+

[RFC3008] B. Wellington. Domain Name System Security (DNSSEC) + Signing Authority. November 2000.

-

[RFC3090] E. Lewis. DNS Security Extension Clarification on Zone Status. March 2001.

+

[RFC3090] E. Lewis. DNS Security Extension Clarification on Zone Status. March 2001.

-

[RFC3445] D. Massey and S. Rose. Limiting the Scope of the KEY Resource Record (RR). December 2002.

+

[RFC3445] D. Massey and S. Rose. Limiting the Scope of the KEY Resource Record (RR). December 2002.

-

[RFC3655] B. Wellington and O. Gudmundsson. Redefinition of DNS Authenticated Data (AD) bit. November 2003.

+

[RFC3655] B. Wellington and O. Gudmundsson. Redefinition of DNS Authenticated Data (AD) bit. November 2003.

-

[RFC3658] O. Gudmundsson. Delegation Signer (DS) Resource Record (RR). December 2003.

+

[RFC3658] O. Gudmundsson. Delegation Signer (DS) Resource Record (RR). December 2003.

-

[RFC3755] S. Weiler. Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.

+

[RFC3755] S. Weiler. Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.

-

[RFC3757] O. Kolkman, J. Schlyter, and E. Lewis. Domain Name System KEY (DNSKEY) Resource Record - (RR) Secure Entry Point (SEP) Flag. April 2004.

+

[RFC3757] O. Kolkman, J. Schlyter, and E. Lewis. Domain Name System KEY (DNSKEY) Resource Record + (RR) Secure Entry Point (SEP) Flag. April 2004.

-

[RFC3845] J. Schlyter. DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.

+

[RFC3845] J. Schlyter. DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.

-
+

Internet Drafts

@@ -482,16 +465,16 @@ after which they are deleted unless updated by their authors.

-
+

-Other Documents About BIND +Other Documents About BIND

-Bibliography

+Bibliography
-

Paul Albitz and Cricket Liu. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates.

+

Paul Albitz and Cricket Liu. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates.

@@ -514,6 +497,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch12.html b/contrib/bind9/doc/arm/Bv9ARM.ch12.html index 8228d9722..ccce85620 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch12.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch12.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Appendix D. BIND 9 DNS Library Support - - + + @@ -39,25 +38,25 @@
-
-

-Appendix D. BIND 9 DNS Library Support

+
+

+BIND 9 DNS Library Support

Table of Contents

-
-
BIND 9 DNS Library Support
+
+
BIND 9 DNS Library Support
-
Prerequisite
-
Compilation
-
Installation
-
Known Defects/Restrictions
-
The dns.conf File
-
Sample Applications
-
Library References
+
Prerequisite
+
Compilation
+
Installation
+
Known Defects/Restrictions
+
The dns.conf File
+
Sample Applications
+
Library References
-
+

BIND 9 DNS Library Support

This version of BIND 9 "exports" its internal libraries so @@ -65,40 +64,40 @@ call them "export" libraries in this document). In addition to all major DNS-related APIs BIND 9 is currently using, the export libraries provide the following features:

-
    -

  • The newly created "DNS client" module. This is a higher +

      +

    • The newly created "DNS client" module. This is a higher level API that provides an interface to name resolution, single DNS transaction with a particular server, and dynamic update. Regarding name resolution, it supports advanced features such as DNSSEC validation and caching. This module supports both synchronous and asynchronous mode.

      • -

    • The new "IRS" (Information Retrieval System) library. +

    • The new "IRS" (Information Retrieval System) library. It provides an interface to parse the traditional resolv.conf file and more advanced, DNS-specific configuration file for the rest of this package (see the description for the dns.conf file below).

      • -

    • As part of the IRS library, newly implemented standard +

    • As part of the IRS library, newly implemented standard address-name mapping functions, getaddrinfo() and getnameinfo(), are provided. They use the DNSSEC-aware validating resolver backend, and could use other advanced features of the BIND 9 libraries such as caching. The getaddrinfo() function resolves both A and AAAA RRs concurrently (when the address family is unspecified).

      • -

    • An experimental framework to support other event +

    • An experimental framework to support other event libraries than BIND 9's internal event task system.

    -
    +

    -Prerequisite

    +Prerequisite

GNU make is required to build the export libraries (other part of BIND 9 can still be built with other types of make). In the reminder of this document, "make" means GNU make. Note that in some platforms you may need to invoke a different command name than "make" (e.g. "gmake") to indicate it's GNU make.

-
+

-Compilation

+Compilation
 $ ./configure --enable-exportlib [other flags]
 $ make
@@ -111,9 +110,9 @@ $ make
   programs using the libraries will also be built under the
   lib/export/samples directory (see below).
-
+

-Installation

+Installation
 $ cd lib/export
 $ make install
@@ -125,7 +124,7 @@ $ make install
   specified by the --with-export-includedir configure option
   (default: PREFIX/include/bind9).
   Root privilege is normally required.
-  "make install" at the top directory will do the
+  "make install" at the top directory will do the
   same.
   

 

@@ -133,17 +132,17 @@ $ make install
   application after the installation, see
   lib/export/samples/Makefile-postinstall.in.
-
+

-Known Defects/Restrictions

-
    -

  • Currently, win32 is not supported for the export +Known Defects/Restrictions

+
    +

  • Currently, win32 is not supported for the export library. (Normal BIND 9 application can be built as before).

    • -
  • +

  • The "fixed" RRset order is not (currently) supported in the export library. If you want to use "fixed" RRset order - for, e.g. named while still building the + for, e.g. named while still building the export library even without the fixed order support, build them separately:

    @@ -157,25 +156,25 @@ $ make

    • -

  • The client module and the IRS library currently do not +

  • The client module and the IRS library currently do not support DNSSEC validation using DLV (the underlying modules can handle it, but there is no tunable interface to enable the feature).

    • -

  • RFC 5011 is not supported in the validating stub +

  • RFC 5011 is not supported in the validating stub resolver of the export library. In fact, it is not clear whether it should: trust anchors would be a system-wide configuration which would be managed by an administrator, while the stub resolver will be used by ordinary applications run by a normal user.

    • -

  • Not all common /etc/resolv.conf +

  • Not all common /etc/resolv.conf options are supported in the IRS library. The only available options in this version are "debug" and "ndots".

-
+

-The dns.conf File

+The dns.conf File

The IRS library supports an "advanced" configuration file related to the DNS library for configuration parameters that would be beyond the capability of the @@ -186,21 +185,21 @@ $ make This module is very experimental and the configuration syntax or library interfaces may change in future versions. Currently, only the - trusted-keys + trusted-keys statement is supported, whose syntax is the same as the same name of statement for named.conf. (See - the section called “trusted-keys Statement Grammar” for details.)

+ the section called “trusted-keys Statement Grammar” for details.)

-
+

-Sample Applications

+Sample Applications

Some sample application programs using this API are provided for reference. The following is a brief description of these applications.

-
+

-sample: a simple stub resolver utility

+sample: a simple stub resolver utility

It sends a query of a given name (of a given optional RR type) to a specified recursive server, and prints the result as a list of @@ -212,59 +211,59 @@ $ make

Options and Arguments:

-
+
-t RRtype

- specify the RR type of the query. The default is the A RR. + specify the RR type of the query. The default is the A RR.

[-a algorithm] [-e] -k keyname -K keystring

- specify a command-line DNS key to validate the answer. For - example, to specify the following DNSKEY of example.com: + specify a command-line DNS key to validate the answer. For + example, to specify the following DNSKEY of example.com:


-                example.com. 3600 IN DNSKEY 257 3 5 xxx
+ example.com. 3600 IN DNSKEY 257 3 5 xxx

- specify the options as follows: + specify the options as follows: 

 
-          -e -k example.com -K "xxx"
+	  -e -k example.com -K "xxx"

- -e means that this key is a zone's "key signing key" (as known - as "secure Entry point"). - When -a is omitted rsasha1 will be used by default. + -e means that this key is a zone's "key signing key" (as known + as "secure Entry point"). + When -a is omitted rsasha1 will be used by default.

-s domain:alt_server_address

- specify a separate recursive server address for the specific - "domain". Example: -s example.com:2001:db8::1234 + specify a separate recursive server address for the specific + "domain". Example: -s example.com:2001:db8::1234

server_address

- an IP(v4/v6) address of the recursive server to which queries - are sent. + an IP(v4/v6) address of the recursive server to which queries + are sent.

hostname

- the domain name for the query + the domain name for the query

-
+

-sample-async: a simple stub resolver, working asynchronously

+sample-async: a simple stub resolver, working asynchronously

Similar to "sample", but accepts a list of (query) domain names as a separate file and resolves the names @@ -274,7 +273,7 @@ $ make

Options and Arguments:

-
+
-s server_address
@@ -303,9 +302,9 @@ $ make
-
+

-sample-request: a simple DNS transaction client

+sample-request: a simple DNS transaction client

It sends a query to a specified server, and prints the response with minimal processing. It doesn't act as a @@ -313,7 +312,7 @@ $ make response from the server, whether it's a referral or an alias (CNAME or DNAME) that would require further queries to get the ultimate answer. In other words, this utility acts as a very - simplified dig. + simplified dig.

Usage: sample-request [-t RRtype] server_address hostname @@ -321,7 +320,7 @@ $ make

Options and Arguments:

-
+
-t RRtype
@@ -344,9 +343,9 @@ $ make

-
+

-sample-gai: getaddrinfo() and getnameinfo() test code

+sample-gai: getaddrinfo() and getnameinfo() test code

This is a test program to check getaddrinfo() and getnameinfo() behavior. It takes a @@ -361,14 +360,14 @@ $ make Usage: sample-gai hostname

-
+

-sample-update: a simple dynamic update client program

+sample-update: a simple dynamic update client program

It accepts a single update command as a command-line argument, sends an update request message to the authoritative server, and shows the response from the server. In - other words, this is a simplified nsupdate. + other words, this is a simplified nsupdate.

Usage: sample-update [options] (add|delete) "update data" @@ -376,60 +375,60 @@ $ make

Options and Arguments:

-
+
-a auth_server

- An IP address of the authoritative server that has authority - for the zone containing the update name. This should normally - be the primary authoritative server that accepts dynamic - updates. It can also be a secondary server that is configured - to forward update requests to the primary server. + An IP address of the authoritative server that has authority + for the zone containing the update name. This should normally + be the primary authoritative server that accepts dynamic + updates. It can also be a secondary server that is configured + to forward update requests to the primary server.

-k keyfile

- A TSIG key file to secure the update transaction. The keyfile - format is the same as that for the nsupdate utility. + A TSIG key file to secure the update transaction. The keyfile + format is the same as that for the nsupdate utility.

-p prerequisite

- A prerequisite for the update (only one prerequisite can be - specified). The prerequisite format is the same as that is - accepted by the nsupdate utility. + A prerequisite for the update (only one prerequisite can be + specified). The prerequisite format is the same as that is + accepted by the nsupdate utility.

-r recursive_server

- An IP address of a recursive server that this utility will - use. A recursive server may be necessary to identify the - authoritative server address to which the update request is - sent. + An IP address of a recursive server that this utility will + use. A recursive server may be necessary to identify the + authoritative server address to which the update request is + sent.

-z zonename

- The domain name of the zone that contains + The domain name of the zone that contains

(add|delete)

- Specify the type of update operation. Either "add" or "delete" - must be specified. + Specify the type of update operation. Either "add" or "delete" + must be specified.

"update data"

- Specify the data to be updated. A typical example of the data - would look like "name TTL RRtype RDATA". + Specify the data to be updated. A typical example of the data + would look like "name TTL RRtype RDATA".

@@ -450,15 +449,15 @@ $ sample-update -a sample-update -k Kxxx.+nnn+mm

removes all A RRs for foo.dynamic.example.com using the given key.

-
   
+
 $ sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com"

 

      removes all RRs for foo.dynamic.example.com using the given key.
-
+

-nsprobe: domain/name server checker in terms of RFC 4074

+nsprobe: domain/name server checker in terms of RFC 4074

It checks a set of domains to see the name servers of the domains behave @@ -472,50 +471,50 @@ $ sample-update -a sample-update -k Kxxx.+nnn+mm

Options

-
+
-d

- run in the "debug" mode. with this option nsprobe will dump - every RRs it receives. + run in the "debug" mode. with this option nsprobe will dump + every RRs it receives.

-v

- increase verbosity of other normal log messages. This can be - specified multiple times + increase verbosity of other normal log messages. This can be + specified multiple times

-c cache_address

- specify an IP address of a recursive (caching) name server. - nsprobe uses this server to get the NS RRset of each domain and - the A and/or AAAA RRsets for the name servers. The default - value is 127.0.0.1. + specify an IP address of a recursive (caching) name server. + nsprobe uses this server to get the NS RRset of each domain and + the A and/or AAAA RRsets for the name servers. The default + value is 127.0.0.1.

input_file

- a file name containing a list of domain (zone) names to be - probed. when omitted the standard input will be used. Each - line of the input file specifies a single domain name such as - "example.com". In general this domain name must be the apex - name of some DNS zone (unlike normal "host names" such as - "www.example.com"). nsprobe first identifies the NS RRsets for - the given domain name, and sends A and AAAA queries to these - servers for some "widely used" names under the zone; - specifically, adding "www" and "ftp" to the zone name. + a file name containing a list of domain (zone) names to be + probed. when omitted the standard input will be used. Each + line of the input file specifies a single domain name such as + "example.com". In general this domain name must be the apex + name of some DNS zone (unlike normal "host names" such as + "www.example.com"). nsprobe first identifies the NS RRsets for + the given domain name, and sends A and AAAA queries to these + servers for some "widely used" names under the zone; + specifically, adding "www" and "ftp" to the zone name.

-
+

-Library References

+Library References

As of this writing, there is no formal "manual" of the libraries, except this document, header files (some of them provide pretty detailed explanations), and sample application @@ -540,6 +539,6 @@ $ sample-update -a sample-update -k Kxxx.+nnn+mm

-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch13.html b/contrib/bind9/doc/arm/Bv9ARM.ch13.html index 175515f9f..474badc3f 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.ch13.html +++ b/contrib/bind9/doc/arm/Bv9ARM.ch13.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - Manual pages - - + + @@ -39,7 +38,7 @@
-
+

Manual pages

@@ -47,7 +46,7 @@

Table of Contents

-
+
dig — DNS lookup utility
@@ -64,6 +63,9 @@ dnssec-dsfromkey — DNSSEC DS RR generation tool
+dnssec-importkey — Import DNSKEY records from external systems so they can be managed. +
+
dnssec-keyfromlabel — DNSSEC key generation tool
@@ -91,6 +93,12 @@ named — Internet domain name server
+named.conf — configuration file for named +
+
+lwresd — lightweight resolver daemon +
+
named-journalprint — print zone journal in human-readable form
@@ -140,6 +148,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/Bv9ARM.conf b/contrib/bind9/doc/arm/Bv9ARM.conf new file mode 100644 index 000000000..cf095caa9 --- /dev/null +++ b/contrib/bind9/doc/arm/Bv9ARM.conf @@ -0,0 +1,3 @@ +TexInputs: ../tex// +TexStyle: armstyle +XslParam: ../xsl/arm-param.xsl diff --git a/contrib/bind9/doc/arm/Bv9ARM.html b/contrib/bind9/doc/arm/Bv9ARM.html index b2288026e..3eb407719 100644 --- a/contrib/bind9/doc/arm/Bv9ARM.html +++ b/contrib/bind9/doc/arm/Bv9ARM.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - BIND 9 Administrator Reference Manual - - + + @@ -36,12 +35,12 @@
-
+

-BIND 9 Administrator Reference Manual

-

BIND Version 9.9.8-P4

+BIND 9 Administrator Reference Manual
+

BIND Version 9.9.9-P3

Copyright © 2004-2015 Internet Systems Consortium, Inc. ("ISC")

Copyright © 2000-2003 Internet Software Consortium.

@@ -49,226 +48,226 @@

Table of Contents

-
+
1. Introduction
-
Scope of Document
-
Organization of This Document
-
Conventions Used in This Document
-
The Domain Name System (DNS)
+
Scope of Document
+
Organization of This Document
+
Conventions Used in This Document
+
The Domain Name System (DNS)
-
DNS Fundamentals
-
Domains and Domain Names
-
Zones
-
Authoritative Name Servers
-
Caching Name Servers
-
Name Servers in Multiple Roles
+
DNS Fundamentals
+
Domains and Domain Names
+
Zones
+
Authoritative Name Servers
+
Caching Name Servers
+
Name Servers in Multiple Roles
2. BIND Resource Requirements
-
Hardware requirements
-
CPU Requirements
-
Memory Requirements
-
Name Server Intensive Environment Issues
-
Supported Operating Systems
+
Hardware requirements
+
CPU Requirements
+
Memory Requirements
+
Name Server Intensive Environment Issues
+
Supported Operating Systems
3. Name Server Configuration
-
Sample Configurations
+
Sample Configurations
-
A Caching-only Name Server
-
An Authoritative-only Name Server
+
A Caching-only Name Server
+
An Authoritative-only Name Server
-
Load Balancing
-
Name Server Operations
+
Load Balancing
+
Name Server Operations
-
Tools for Use With the Name Server Daemon
-
Signals
+
Tools for Use With the Name Server Daemon
+
Signals
4. Advanced DNS Features
-
Notify
-
Dynamic Update
-
The journal file
-
Incremental Zone Transfers (IXFR)
-
Split DNS
-
Example split DNS setup
-
TSIG
+
Notify
+
Dynamic Update
+
The journal file
+
Incremental Zone Transfers (IXFR)
+
Split DNS
+
Example split DNS setup
+
TSIG
-
Generate Shared Keys for Each Pair of Hosts
-
Copying the Shared Secret to Both Machines
-
Informing the Servers of the Key's Existence
-
Instructing the Server to Use the Key
-
TSIG Key Based Access Control
-
Errors
+
Generating a Shared Key
+
Loading A New Key
+
Instructing the Server to Use a Key
+
TSIG-Based Access Control
+
Errors
-
TKEY
-
SIG(0)
-
DNSSEC
+
TKEY
+
SIG(0)
+
DNSSEC
-
Generating Keys
-
Signing the Zone
-
Configuring Servers
+
Generating Keys
+
Signing the Zone
+
Configuring Servers
-
DNSSEC, Dynamic Zones, and Automatic Signing
+
DNSSEC, Dynamic Zones, and Automatic Signing
-
Converting from insecure to secure
-
Dynamic DNS update method
-
Fully automatic zone signing
-
Private-type records
-
DNSKEY rollovers
-
Dynamic DNS update method
-
Automatic key rollovers
-
NSEC3PARAM rollovers via UPDATE
-
Converting from NSEC to NSEC3
-
Converting from NSEC3 to NSEC
-
Converting from secure to insecure
-
Periodic re-signing
-
NSEC3 and OPTOUT
+
Converting from insecure to secure
+
Dynamic DNS update method
+
Fully automatic zone signing
+
Private-type records
+
DNSKEY rollovers
+
Dynamic DNS update method
+
Automatic key rollovers
+
NSEC3PARAM rollovers via UPDATE
+
Converting from NSEC to NSEC3
+
Converting from NSEC3 to NSEC
+
Converting from secure to insecure
+
Periodic re-signing
+
NSEC3 and OPTOUT
-
Dynamic Trust Anchor Management
+
Dynamic Trust Anchor Management
-
Validating Resolver
-
Authoritative Server
+
Validating Resolver
+
Authoritative Server
-
PKCS #11 (Cryptoki) support
+
PKCS #11 (Cryptoki) support
-
Prerequisites
-
Building BIND 9 with PKCS#11
-
PKCS #11 Tools
-
Using the HSM
-
Specifying the engine on the command line
-
Running named with automatic zone re-signing
+
Prerequisites
+
Building BIND 9 with PKCS#11
+
PKCS #11 Tools
+
Using the HSM
+
Specifying the engine on the command line
+
Running named with automatic zone re-signing
-
IPv6 Support in BIND 9
+
IPv6 Support in BIND 9
-
Address Lookups Using AAAA Records
-
Address to Name Lookups Using Nibble Format
+
Address Lookups Using AAAA Records
+
Address to Name Lookups Using Nibble Format
5. The BIND 9 Lightweight Resolver
-
The Lightweight Resolver Library
-
Running a Resolver Daemon
+
The Lightweight Resolver Library
+
Running a Resolver Daemon
6. BIND 9 Configuration Reference
-
Configuration File Elements
+
Configuration File Elements
-
Address Match Lists
-
Comment Syntax
+
Address Match Lists
+
Comment Syntax
-
Configuration File Grammar
+
Configuration File Grammar
-
acl Statement Grammar
-
acl Statement Definition and +
acl Statement Grammar
+
acl Statement Definition and Usage
-
controls Statement Grammar
-
controls Statement Definition and +
controls Statement Grammar
+
controls Statement Definition and Usage
-
include Statement Grammar
-
include Statement Definition and +
include Statement Grammar
+
include Statement Definition and Usage
+
key Statement Grammar
+
key Statement Definition and Usage
+
logging Statement Grammar
+
logging Statement Definition and Usage
+
lwres Statement Grammar
+
lwres Statement Definition and Usage
+
masters Statement Grammar
+
masters Statement Definition and Usage
-
key Statement Grammar
-
key Statement Definition and Usage
-
logging Statement Grammar
-
logging Statement Definition and +
options Statement Grammar
+
options Statement Definition and Usage
-
lwres Statement Grammar
-
lwres Statement Definition and Usage
-
masters Statement Grammar
-
masters Statement Definition and - Usage
-
options Statement Grammar
-
options Statement Definition and - Usage
-
server Statement Grammar
-
server Statement Definition and +
server Statement Grammar
+
server Statement Definition and Usage
-
statistics-channels Statement Grammar
-
statistics-channels Statement Definition and +
statistics-channels Statement Grammar
+
statistics-channels Statement Definition and Usage
-
trusted-keys Statement Grammar
-
trusted-keys Statement Definition +
trusted-keys Statement Grammar
+
trusted-keys Statement Definition and Usage
-
managed-keys Statement Grammar
-
managed-keys Statement Definition +
managed-keys Statement Grammar
+
managed-keys Statement Definition and Usage
-
view Statement Grammar
-
view Statement Definition and Usage
-
zone +
view Statement Grammar
+
view Statement Definition and Usage
+
zone Statement Grammar
-
zone Statement Definition and Usage
+
zone Statement Definition and Usage
-
Zone File
+
Zone File
-
Types of Resource Records and When to Use Them
-
Discussion of MX Records
-
Setting TTLs
-
Inverse Mapping in IPv4
-
Other Zone File Directives
-
BIND Master File Extension: the $GENERATE Directive
-
Additional File Formats
+
Types of Resource Records and When to Use Them
+
Discussion of MX Records
+
Setting TTLs
+
Inverse Mapping in IPv4
+
Other Zone File Directives
+
BIND Master File Extension: the $GENERATE Directive
+
Additional File Formats
+
+
BIND9 Statistics
+
+
The Statistics File
+
Statistics Counters
-
BIND9 Statistics
-
Statistics Counters
7. BIND 9 Security Considerations
-
Access Control Lists
-
Chroot and Setuid
+
Access Control Lists
+
Chroot and Setuid
-
The chroot Environment
-
Using the setuid Function
+
The chroot Environment
+
Using the setuid Function
-
Dynamic Update Security
+
Dynamic Update Security
8. Troubleshooting
-
Common Problems
-
It's not working; how can I figure out what's wrong?
-
Incrementing and Changing the Serial Number
-
Where Can I Get Help?
+
Common Problems
+
It's not working; how can I figure out what's wrong?
+
Incrementing and Changing the Serial Number
+
Where Can I Get Help?
A. Release Notes
-
Release Notes for BIND Version 9.9.8-P4
+
Release Notes for BIND Version 9.9.9-P3
-
Introduction
-
Download
-
Security Fixes
-
New Features
-
Feature Changes
-
Bug Fixes
-
End of Life
-
Thank You
+
Introduction
+
Download
+
Security Fixes
+
New Features
+
Feature Changes
+
Porting Changes
+
Bug Fixes
+
End of Life
+
Thank You
B. A Brief History of the DNS and BIND
-
C. General DNS Reference Information
-
IPv6 addresses (AAAA)
-
Bibliography (and Suggested Reading)
+
IPv6 addresses (AAAA)
+
Bibliography (and Suggested Reading)
-
Request for Comments (RFCs)
-
Internet Drafts
-
Other Documents About BIND
+
Request for Comments (RFCs)
+
Internet Drafts
+
Other Documents About BIND
D. BIND 9 DNS Library Support
-
BIND 9 DNS Library Support
+
BIND 9 DNS Library Support
-
Prerequisite
-
Compilation
-
Installation
-
Known Defects/Restrictions
-
The dns.conf File
-
Sample Applications
-
Library References
+
Prerequisite
+
Compilation
+
Installation
+
Known Defects/Restrictions
+
The dns.conf File
+
Sample Applications
+
Library References
I. Manual pages
@@ -289,6 +288,9 @@ dnssec-dsfromkey — DNSSEC DS RR generation tool
+dnssec-importkey — Import DNSKEY records from external systems so they can be managed. +
+
dnssec-keyfromlabel — DNSSEC key generation tool
@@ -316,6 +318,12 @@ named — Internet domain name server
+named.conf — configuration file for named +
+
+lwresd — lightweight resolver daemon +
+
named-journalprint — print zone journal in human-readable form
@@ -365,6 +373,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/Bv9ARM.pdf b/contrib/bind9/doc/arm/Bv9ARM.pdf index 294d179101916d9bb478db299fe6075520f1b981..5dd76894943fc1f24fa84b401c18554747b78011 100644 GIT binary patch delta 865906 zcmaI6V{~TE@&+1vVkZ;Zwr$(i#P%B}6Wg|J+s4GUZQVJ4-E-IZt-E)BsOsw7yH~HS z?x&xs_}|KBg`y;+3L;{(jC8Cpq_c}dD==&X3zY(!$CcAbUy_W1B2_91UmCqdVT)#D21!}vo8ykL`3NG=dv`lNJZ3O_ z0ej*Td>ya4c314gzWF4$FQ6o`U$C{-vsR$p{>#=~9oq*=n&ahQ>axpEmzLP)mY4|- zsPKkxpL_?`U+60o2mO93Xk5qh=^gC={^cAe-t_d9z%^7Wwj?w|O^w)Mk&>4f>fu-f zt~&Pm#?Ne_?I1GBnd5y2%n}hjN3-dEcdJmo=DQ2>WL*6Cb1_5bzS8#)_X(El~k8#>z1Coq~a zVly)R?MMlRUP#E!oj{x6ufq1Xik*{5H{r~RGU3`37nnH#-i#WUC4t8b7nn6c+YASo zt--_04;1x3hsDUzKy0H73=ES(m<@}P-~|lbfNFQ~Pc5048ql1qssEu5Cgzl>Y+$0m z*6hFCFs{L&g#K0kR)G-xQ)AZuY8*QJTdQ-0s2iPQp@2n)iqn(aC=9KtTy`kTO-1k)3~y@;i)k? zgE27AJ$v*!?0JiDyw?bv8ohmvSB@6&pH0@{ECfs6zf%WjxLE=TdNni3eQG+YZRHgB z?j^T#yPT6qu9WLR*@&em73*ZTGJJeq67vdqE=y!1eBRs7*WV83)v>QN0B$EPEsF$B znCasSkX*;oUbb9a-c|3!o*EdXlLy&GQ=(Vf2xEEiQ@#R=DiXNVnJ;(#x4*Ol47|p8 zQsWx5th<-rtzynU>n@P;_|;OW^wY1`Hhs9TpyXxsuO9>u4FxdGa`=C}SA4*K-+5P$ zqa#%E<_6_vwj1-KyMNA_0JW$t2##M*ObauwcX1ebDwXGJqrfju+!BOXy@uS@aXmRkGe@d00t8}I^Az&%g@h0 z0~>Zk$AcJ5SwPWKWtkfLGG;#%P!B{GWwKD)q;fWoEkEq>A#5#*dNer&7dsK*V`h(LHvFs3lq z$*Q;>cpM~8$-t5$0ES(4>qi?{JtfHwTtRqXlX-lq!Kudj!djhWZk{T z&<@i%DJkEIMXf_0^W{ENlSiu}NeqPL6-7$DX@3e$)UF8bvXG#T6ca9~vOD#C+&)Tb z9h!z8=!gdLp-!o8#UGozI&`i)e-d*`fA#U$>z`t8UGB-gfc70fwUZr}y3vqBdzU|P z`BmuX!V#W}TbC7z062brr$E-y^VB>XOcZmojK!A6)6X#sX`~k31&}}N7s501O(XT- z1X1(*`ZT%Y!_Zl2e2;eA_f`O#^scMwcl~VytQ0#|Z&*2(G9aCq%;4$Es`YTFzN}t2 z>u2TcSf88c)Hg_gMsX~mrGy}&aD5t!U*56kM!BruB%a-njtyClH# z5>e1Guj>Ohq%%8m@f4 zm1@WZAmWYnXhVCKxxt9cNYCD&ga9YHCZg3Lhq)3eYL{mOUC066V3P+=ouCv#f*L-J z+!dx*MsKL?_Tlm*2tw2TF%J}Jo5+hJj3pki#c%VvInbxzp0mqq zkN)G!pGl&HKhRt6<9fZpyKtx%=oW^PpGrC-g4o0B55!e)+@ZYznUiX=0szTYa)TD> zM2-A6V6XXH7U_tq2^zd~&G@PjDa>u&*mY6~+P*IiSLgXr#*S#EcbjWdwZXD9!1B3# zwU_7YE~wKjn+`HN=u(_MQM-)l0Au0wxHYC~HM(r$wW1)r!vg|h%}b?&!aI%lYVE4c z<8|c1XF!{5__m4~bAY?PH{h;@`?jJ|KudGiM>A428&wN}XQ*drg98wL&t)IvHReK1 zQkJwbXOL-9&;*wzU^im8?q5`;)98PgU)fGYF3Oa(LfT@bB#K7#k_}`d9?u%DQ}*DE z3?ZZ*q{RfDR{>X7^&CxCEl<<$UOeu-<2M{*8b4B2ftNw=pO&}?3t(6E3xkNSK0)QF z`Q{UGk!12_E8yLjtbkoaae~&59Uwk{!*BKsy6L>*?tZPeSQf1$M73k>u}x{JfUen7 zIix?gSC&NZ`-ZEf#!_bvOw(7Xs$SKZ&NP#U=p2`s(yd9G8rSmqT9}@P@YV(v`^j+B zZhh!ne%J3p#wWY41Ayfx*OK|IYd*t%>YJ~M?BZd~_!~JxB;)6uhUqrpU;$GMn~Smw z`VYpGY;PNM(w_EGMJ{zA>XJW2==>s?rU?^Iyh+dK6>+cK<7D(xT0Q4ZbO;Q~YME*+ z^s3o74k3vb6}I|;lXi{*Oc)OMswTuQiY&kD1%LK|n}yOzas%!Pt>g#Pwxo`%syUn2 zQME?Y+b3$unlWLmI!k>_F5O6<64O`uzXT8O)hW#GnkG_HP>t`)Fh|abL^ngD8ZZ7Z zhDbI#rQ4#kp(!p)i)n5yB0T5TJmdt29EIfI$iHWaci^<8T!w}DNx?%{9$(=FrS5(hI=BA1ao6|UwAj1|? z7FV;i;`bfk;8yUAwGiF6Q)=S0)QMs1OT zq7=?-@m`BR?cZR18hYYch^2wQkkBGz4$hIv`%F=C;cdNW?d^<12yBSme8iX9 zF4F#Z6~mXHu7q(ywYM8XCh1P_L0AHi_$z5L2zo9xnyJO_udv5oTX@vXeP_AC4D6OU zRH*^3GyzSb)oPL~5#rp`Y{T&4OC-549xoKA2ipsx$s)>+$LvtI zDkr}!H@Y}It{FVMU_Xb~e?L9>GL6#=t{IWV=hyeuSmw*3XyGkV=B&!1;91XvZ z&$U;_3631T0THh(wO+tMR)u}u*cgvRK^|nOIb&m=5WAu{h3};4QzdIL_qrL0$0Bv9 z6G<2-C?a3}*XjXb6})_KZ@d%90V5KrDL0;Q8D2i}Bt#M69BCBfF)AoLVpNmAqTUrH zrX-Qrvh^9oqVhiwELpZ{FG~St1boZ6OxCF5l40+XdM4<<=*8sqbX1fW5m%K=-b~6_ zJ?WageQY3>N$qq}3^t(5u`(_rC~C}n%~_D!k{well`02>sDkm0A7tN7G%a13hbmA9 z7Fo|XCo0`uDA4v)sSb>vF;Hs?kadnx2c^(OOZuk+Ufuk04oeNv{neg z*{()w{ElG=^LpS<*I>FsDZM{{x?Nu``&L~exIM{wdLmVi2;rGrK2WR6KT6WcMeAck z>p<#8U5n{>jFCB}7kEYPFKQ&;a?4F;+q6;`GmpU(Wrg4Q66Q>ICthp`fo~5>OVK{_-fS^vb1gfMrDEsy*_@&A{WJ5}nE60zCE)Y1yHRr)(m0SDx{m9(y9HRD9) zcawQ;4LtGcu>}KO=4~{p83iW7kn`cpl6Vr+J zwZTF#Q1&JujG6)re5=&y^M`-l={p!AiyN@~LL6}~M{uU%LbO27y*lKSyj)$|7$tC- zihvSW5*_&nff#S7(;{#7;1$J#Cp;s0V7Az1V@dlyP0Kd!;FfOu+EW`&hd=+F@xn;s zg^&|uklvKP__YDG@{G&d(?+Ni%2c=^5dxKG4O%U(tPEt-RKq8#4c0Uyid-MaP1O>E&Xn#Ax^JiW~>nG~>o zF>fWHz5DZn559rnnVFfG)K#>zr`K&(t$W`dS8O27j_r>C1lg?^N<& zrBzmK=zV0UAli^P*E7_*#p3oju*vCeuv?%b{geWO1kn4JFlG1*FwZy3h2D@>nT|`XyD~Ibm)b z%KP57si06~YjRTxksj%WV3;+jjP=1;H6Ivp3=TQJY&d5FJXd`Z+D`{x($qT~*3~G@ zp^u%!dI>49=z>^UqPObKW5Q7dq`LtzUoTks6K2YkE?d?jmTc6291{oik%;;@Sj&Wx z^mJcae9uO*zXQe?LY!0PTx7*2Ws0B1N(>K|7FzkD59NmUk|X2*L{K>$ZEorw z*_D1}Bpx-ZOMypKA4_qo4l)%t3*L^%$5;Gh!D@~(EkU$c5v<7Wj1h1@s`mgiE>m>1 zVMy^;4J8UT{lZz>_Fbi|&Z|BdvyqmM9h&@ZPT!$-=98?7*G17*;LaUDHhpwqK7phh zPp}1H1NdZ&6+zx(8@-s2rtZr>#~}u#=e#5{OGH1N(YTioS*i8Qe^!9nqIrzj3m#+; z*{QW3ne@zs)L}%0`u@}eE+PZS8j%HDIOz3jqm$5#gR|EYzL-fiEZ=|(G&`b1FGK23 zy>I0#ii#P7YO$83FZjHeT31Lb1nADbKuFJ4+Wo#+C*Fc++JJH?d!m32$cIwfmm?{x zXT&+S#z(nszA_EBhwaoZ+!DG{a3}e-Ps=O*koe|uipMCdT9A%~(V+v7u!PiKJSJPJ zyFycwK{L^+yoWhItEdohasr1)g|c9acP+y6f=3UcMUBsUb)&$W(Y$Ue*JH#YI1jT$5oDMJQ8`fOOB4n~8keHYkbxhqm?IHE8l9%QfYyi0|PmxHe6 z%x9Oq64Iz1Z#T8&>8i3yTAHR&M6c4}H=+$hC6x%_8mlL09)~(AsHn`o(o`f$Vil#I z6s4F|;Z#^^mBA_nN|v}jcj;aimF-2yno3pFvB*l$M(J^;TH-ek z(;InB0Sz%Pm0{8c`EhqRSL|6nN`bUOK_uO#1{grH5H9CrpAiJSLi8NIFlRmhs8H~m zB0(4+P=bo~OJMg%#t%kp43ULG48x4q2r`TU+o058yZ~_5YGkEV@Dq@3IuGb2noRF9 zBHy#{7BLnX@tZ?hVVr~F_xRD2ZvX`4^n@-X=y1*OYh%Jmz)OV>@jz}|e1pL95anxt z2rM9dtQ4rfz(m!atL#9LFskh%B^$434q6Cbpo(p>g9ZbS@y8dI$ zFZiB#J{Ld#0XQZx1s#llTM%$(A`rpwY?6mQZlzo;sP88g-|;tpei=O6~_-ILO?&9*pX>` zzX@?fGE|99o^ zvDJt5t7qBp$XS1XfnM3|!s^ko^y38miw}$M=i!1%)C}2mNx|)$V_g~@+poi-eTxsP zcD=32>f&Fm@|*TtUD>kmDLG5QVxZ*J_Tre(s*JkPe)awKGI>|Jw)Tzba%>HUd+zmV z<>DiNz#dDRrlAL#B60xNSK*_4jC9YT6fak+UUyb`!s~}wm*$eJ_%Zs=X|;*-jEd9h zk=0ve)|@U~Sv7r?%0{u2g~P|Hbq=Q4O-s*w;kK#sRkLV#@?&wkqlxDU_KBg7i464_ zcznCp>?$(=6ohqd_Wk{sC+Nm%$LhlyjzJgb@JYn&*xcN%Nff}>o)WIR5?J0!k(6!8 z{aZu$7qsGI3r0eW!M*n#_`=nSlPTl#1WB>C~Weo9Vr4%5>%zg>2g9fL3&k3z=Ml(Scb`b5UiqZ#Y_ z!@6_RaCl!pgDgPCEaKE^S)!xK>Y1B^Gs~7t0gx}F2Vg;?EkcW%-I%jR6u7o%4l8kE z;WmAVHWN8Cs-w5%!<$Y~$46}`cIpP+jCs7EtXZ&YIL+DLKlOa_by&qbb#$qBZ&A7X z{5ZNSRy#LndUa}hyUF#4uX45l5*-;{@clmSQJGB|xCan}aX?#JIWXtwZ!IJ^%9m7} zOkHNn*TG4Byiy7|QTfskmNpYR9Nk{iZ-1G4CV6Ff4<;Br!}1)TdABQK*gJDfy*xhL zi(TekM*@-g`~;DCxyAJJNMDgbook4va48|HO4~}`LXZjQNdx;HB^ic{7(%wksOLxI z`g0(y#|_8`ZqB6V(--PK&|L2{qMI2uMNLuE5p%#A`Zr;kB2$s0z+P-OvLEY^+U3l$ z(fa+>8hC(Dr@FeNLJQJ|^UKAXiLX8PEdmPCtGzclKRy%zQX8isK|bTOJb$FzA(D5_0H6=PkiXk@=S?2L3PB{Gx(JJqQ4YqxdTU=7z9BmJ zATYQRzIJXTTjT?YunvmQ+SEiV2xYs}#$@{~5(LyChL~b>2=YUKB$cXF3<;x5NRJT+ z>4+*QB-BkcQW(m}I0=MZWQUmxo-m9t>5-NQy*e#KLBz?_I0C8-rfvN@2N3oH$*`#o z2}gM7059^27mWEFsk2lR^u6R@BhWLIub&(FUdr*~Cz7j${7;cLg+T((CXC?_7!$6r z2gGe!LeJG?A~E$z-S7v4axzYyTN`1Kb(l0eNTe(OFa%YpsCy$6&0q_>hcrC&VFosi zbZl%r^-+2J#et_?=Hd2nDL~gR=|RI02}2+vlD>+fu-hbdH~LBMF3k;Z?}#D~5UgiQ zQbLsjUPm8YaI3O>Wi;6oDzk493ZkIXVI4|Br>5e-uuFfakKyLz&>i;S5a6)d;p8UK zAmu}ylC0Ks#UH1%BiGX}b}paYiTqS{&79vpr{4$%BO==*qapxWVZc#l>+mG?5iYCQ z9piE7f0sJA(KOr1wLzYtL`5YrNi0&+#Q%>Fhwa#{)Rykpba*zNG_jQOi(*-$8oVY< z&g1TVygp5a^qM+A(mjO4#AT&my%eN*68ELgd>k*QjvL#3g*n+u92CJT2T$&3gHIUn znj9t`>zG#*I$Xfxa>KxT1GQ2bDux(ia7Kh65Cl4ZCWd$&=Q;w9*9?irruwJJogjrd zPdXM)W(nuOwz`Q)P5oy^w6A+F6H1GF?4n^i*zPCF?x=e;y9g%TVw}>`0BABLTK!Li z)>$94`acV-k4R!?XPK6kAoMU;qkPth0fr!?Q9{xX#}{UE&#i zD&vLC%nw~YlOvPkol;KU@WMu;7cbliW+(XS0>w}KA&E$NE+#7+8d$qY3=4&KG}wQ%*C4?zk&#c0E7gBg!ZJX6ytgABUkVG;dMBCb zrurmQ2?F9=R~pM*eaAnM5VJB9ptBL5M?yaYsT5*RyVAsJvZH$uqEwvt;%d@eGx*G! zX6z#P(34{r$L#sav)KL1tUuJyKk$m?Zkbvc3dU=dU?pO;W5eRi zS;#{06!%GmGd8!=ZblgPh`&tc}4w`wq zd(yPB2+<1NHE4UwmKu5*QbVxYKZnsG{*C%px^Du8{cKpRB*0vy46JlIFkKcXfqx#L zP_a%vi#TWO{(=~B?H|&~>rm{1IIWV7|Af6wGYJ5e8@Ims2O!GK_-|13e?q#9Ozi9_ zg!l-QfDCP?46(m#-Xo>^N#H}T>vc*uXWfM)nS)Y>47baDZ*J7kA_zt-?(>3Mo7hg0 zU_GykDX+gluv*Xkwv*;h!Q*lN>C=-a_P19NLUG_BMz>D8Xg?t8Q>bX*qVZd^>BE=H z5@tKkBVCzp&+DK0BnBIu?^{)Ki#VUWLPzM%0EK%3GT`GuX!L@Kn%T58uj`*slggRv zMhE?Qkw9X^C7e4N%4BFW+VFe0H$vxv< z)AUX#GFnsnZtK2Kgm8m3F~twj_|ucf^_9M*w<#g_ z4x#>oa|C;610@7oHP-!0=Ma-p_P4UrqcEwU(26;QjN_F z2F<)XQmbWhYFu@x>s-_3u!#(rpaixPKz zf^DP-mtyI+KQ7|FXD;ELIDD%CzzJC|gL!z-7shqH|LPW<@Tq^O50gSCm_*{WviVCu2IR4*1o`@qHse7&6) ze!(EEc&fje)8}JTC{(z6CLR|exj(c|?X6>06J1O_Nv9J5oX^u9nA=z!5cu#xr*&GW zSA_qWkueNmSajo-qrNDk6c4&~IqN%q#6^kaYOM2@;SSE36-2LgteK$T;(!f@RW&NZI(K#!6_fD&`$0>6BPl`BA{M()6$B{x%iERGU9vbCs|f&yfy zoYFFBE|q-j`Uv`J6J|sQ2F9Ucd9E#J{N6BvgO0V-&;lLZ8@rU^2vEd@Q3}a&-v;<`kKqJ9Q?tiCno9@?okAv z>jr6asuCxIE~|n08@YQl3ohsvQk^R+mj;=ktNQw2&_J5pM{!p_fbXY_EFp_nbDrp#45Qdm-z0lk^4DZ1n$oOq~UAoDDe{)Xc!7=o>j zR4nU8dJqkkr!27w0F!Z4fn!0ugCm1fjv^+QuKY8pjg*O(W}F)ldz97bFe#|N-&8!O zrkG%x_T*3>9s&(AG>4ilxrQAn{VeKq(0c4l)#~_=&>M9h38C z(QjqZ({;*6AoxMS3l{^r+r~RUGnN})y#xk zAY}Ga7O+|$p!;Pe6)|06;E2z5Pp0j|gaj#X6v2oE-*ySCAmIXEB~_D??z}74@d3XO zZas=Z>2PMu6Q}czLp{~LA7Rmq<`G;i@xW#n*Z)F(;9-SaU=G&anLpbs5cTDMiXGIK z*w@;()8#!}%&{dmwD%`>JV*C!THJT)HhZE}t+2^GDgpJE%jccq&V=Vgdg)KE#hvj@$0%f9wE5i88Vt$k zp@rs;zv$dt9Pb1qOX`=W5FFd)nerZ}?=A{r`Jr~c5S8lK0;h?xutf0t0Fg^(v0GHr zCifyQ!z>m9Ew%95U1LLR-X+1w-H0#W$Ynh$K{>@Rw~fT{eN@7;;}v2ZS^!MWhR$M5 z%!cq7BOH9?B^IXJ1RXN=vgwRWByj+Uo$Xi#-;VC)xR$sOFCkIpG&xX96!$Ks`BKBU6f8ugc4UD zKT3y9s-Q(=*XW{t(pf7Cq&JAYS%ni1NOi=`p4Ku&s&dPNH=Vb?&5|6PH(Cl4tMqiC z(z1>HNOa>5OC#y@tGKIusS_3(QLe@x6ua=2x}FiUmlj=>q}CDQi-1Ev_G|F1Rmv*_ zr8nlOX^Gkh&dq`XSyM6sGH>?>>g~czTMAsBdet4+$}X^LPB{}?b4$5XlY%aB#IxpL z{Y8q=cI3kjto>&z*o{mzElyOKD2L{x%x5$Ya^*v9y=H^oi(GVS_L?>ByeD?y+s&B5eQ+=2@DQpTRBMXHbwD;0({$ zH)#=uHXwv4Va@=*79+VPJFmzg3E3Mptkkw{PPr&Mhm%hy>h}dD8I`ohpqqCa)H`_y zAyBLA5182;LxUQtL){pX#>_Jpf!}4}_bVV7R^hUdt7ZGKX@fZw2`=2xxH=qylt3ae zzGmwxgIA*EhY-RGwjahUDB0`Y$zA{KBt2+EPSa&i9m#U6{aIyFF@Cub`utit?@{qba0b13Jegchn7bv3w)lr&Pio2% zRmFXMtI-5hf&Z^TQ|&_=Zo@*A3+ffi43zWGkD~FXF3hf)Wm8ps#-zx0ts#f~=WFSE z;kM!axesICkBzYVykZ$cI*WTZfOP-W?`(HW#WH9FzB?ZNJtv**MaP!^7f}=bUoIds zGs{056`U+7{-=Kfr6snPj_Bjz+# z*@Sr`K_y$bJ!2Y0kl>HaRC?C?lDC9QCOqB9{O7P1dgIl#!WGz!dH*oLX!px9pra|x zlg%m-UV2;W0N4U~pEc*s70&e@sgpww^XQi1#N^8@oqNXPZ$RM=PDM3)#s^Nro($}; zokgp3*Od$A#kv5g8@^7 z-gth{k)#!Br_rF$zExx3W0Z#%(|^t!7G^f+9u~ANNWAWVz&vrI28ejq{Qd(go93fY zi=3ue7{IT?qGKH=nRvHh>3%~SKropJR+gXS%lPYKsF6SIIKjh~=OtLSP%#etm!1f8 ziZtpm(?{uh4PsOnIn*wA@ovTtW22dKAl%-|{{BLsD5G~)flY2VQJ+;diL8a;*jY*5*1@vx@0LTGg#y_t1Z|EEzX2y8JjDSGD72Grb;fm(WS%UOMMT@S*BxpNK ze}yt>t3N+992`0P+pN~*_L1krEHHr?r73%JAd^Xhi__4xD~wCX_4=Vb2ctnF~}mEh-GkIixT*_NQU+SfJ@8Vc6rZAR6opSzWRls`2KUj#aepzj0uEwhQx4M3bu*u zIF$8vRr?NjrqIvnBiqdK91gk3$ajgf?0<+76thQvxoaXeq7=~^b2k+9$g;BH#sK;; z^2Lckz(p4@*9N-R<7D$0?(*N-vo3fxJ7epc8P|Z2enfyRR&`mt_1`PtT1K0?xHOEwt&93LH$jDex;>E5jQK1a4W%mU%J)1P+_{HB$Uc(H|g1drqOg zu(zY?n4g!xrCcy4cR1~n5rG_mts(nNj7E~%b~zj9OV&CTjzJI1Da8-s9@k?E!tDP9 z^26(7wqF?Xi1*L?z)Sh9}6*eum00PmBTR-wzU8sqn*jx5x zFiK7ZWJB){djknhPw9Ax;X6RP7;_7m8H{HiZp|f2SBBDpx;myohAmd)O$ex5aMvP( zL9LJUQg)hF0qA1o#G*QZ>Ciq7?(3-RAks`Y`&Hjq+6*tz-fO0Q%@u$22{>X#Ycyu> zu}O_nTCTLM>6w~^PcIdr!{dIH58Oq>koKJ@Z`%wX2PE6Nn?LdRx;KE+W|zv-LR*`4 zAT*HA6;a#LOcP?HRAuB(b5-T;a2I0eiC%+da-U<1=B3gvr#K{>-_B!V4DGxNUbBd6 z_HW%;18OjA$I44C?PX_52;I696vkyJF5X~oRiL9_t?t*w#6CA*1$9sH$c*4Xm+%P- zhelaw3XQjWAtT<}qxk@mj4?-TyBL>_YgIRncSoF<`3MG5TBnYmew#A1#?_+}kv~99 z_%?($Y+h{8cq`JSZ(r{qY`lsRuI_FxvAuqn#5+CNCee1PK7DdOAJQByn^GiY0NkDr zMS;VK*^3^%&=^cuvZwvN4m*}ljzzoP1<>9LbO#D}{h2XN-CzN(uiI!Bd*2GRPRYGp zV(u`mC^%Q>Zj>vs&r4#E2FGOKP_v0Lx7XO4m?R0aZ3Pl;{;(Y0eT%T(&*CV=Ic#n{ zn}k(Ez)k@9dQ?P&Ma}H1?hkB8H1Bul8kblp{ip-z6ZUA0$S;0~88<+d@MRTU*leLh zPnk4`GP%(o(QiNoozF1r0UGp3k{D6iH@j{_qPaIPV`m2Xc}`6MzUzw}C0r!ie_}62 z4vv32)c=1%ww#O{{}-}lVrF9}_^;<*0bOfnQ%8bidoV1(RQk3ZZrhKM?Y|(v_+6n& zB0L`q4DtYS9^Jx!CqA@U5YPL!!;kbe|4X1#z&5?xVU`23_?T%hFMRY^o|wP#d~dwH;#@&uZ`;cNdMnAbo_``WNlS0j9=Wt2GW%#Pfr-0e zgL24k1|2j7EVP(6lYo7!gPI!(choJSooS20|cY7Vcet#ncx`c^?xoD2yr@k z(H&jDqy$m$O!9LR=OQ>LI!xkoW5XgM4V70JLd2v210DA26@P!Z7#dv`B6Pstq`uL*rNxjSils2T?&nVKEmM?XdPi)#t@N>%L@J-$eE%*p@Ou;-M z(yb2wq!rSRWv{^G*$0$vxyAsO+XjK9Rh)PO4TqJup|+BgJ!r`|o>+elmtI^L^4zOL zffbUVyIuB{yTeVUCZcLX6+7X%1-wX8r5FB0b{7}0#q7NDg>#s8I%Dq zbHS0L?MT}l7f-HuLoj0 zp?>@=h898{ORkgW-E+tf#S%o_Fck>-H%0EdiyvV<6ayoLJ>&8op=aab>uY^I;@i48 zhOTBSQ@=|lwf%JIiGIDu7Qd%(6F=i}=D5bLf5IBwhe@!Y&Is>dji|4>@Gw3fneUK$rA)|59+$kk70<)qY&?qVkFcM z(^7NQI^H5mZqSGnU6TbY29b6hQOpRC0aUn3Y!H(c9@C;fxtkbC>z3{tn+gTnVB{LI**R31*I<$d-nwcb3HAqk- z-JrLSlE_BKqH!qGLqz#*GtUEA&l5Slf5z}V2Ji)IsW}-R=g}8P^tkEHW>+^JAxzf$??T(_i`7^}ayeHeP zIfn4{WAA89cDv(!L{Hzh)zinfOZtaf%a`xh(dBBvM2sOj4~+87VzF6lyC@HLM*viz z@Oz2dzE_mny8&k$`Qdx>ldC-74C}Sp=JWXv!0vsUmv^&eQTwXuf$dq%OWX5TS5?>L z-J1cUi^t-jVv4vf-oFVOhc3bHTU~Y?JXd$_^w&!c7YayD)QdK7Bfmuyu-eiIgfUFW zg{eg_xwaBHa&xCfWe_MNKv~W$4PY)%(z$ATtL`{{P>2JjV&G|xu#7l+6Rj8}Igw-} z>kLGl{U~X*esa@AX!PPDksHb|BuOW0%)>yYrQXd3;D}}m4v@m2H$q}N(6dK&M=^4s zSSX2hU^?Vsqcow+Q4Dt)yLm{%W37x z+@i&2mgWNV64c2xa~P7WYBVhTHi*^4(8SFlYWNCylwY7^kStKqGl1IOIACFDQ!9*$ zC>WdiJYTs?(jf08SeI!Js6*HOIb)s5E1TOF-aypGJ&RgH7ukge(KtPuNI;S}v|v(0 zl?Go_hqkk%%4kV(EH(MUb~Q-ET~b!H9VLlu@nUPVU$@*Iu(07f7Yy|adn zI8d*72}Yoi=sENT6d+3ZN0J-}Y3qGO8?h2u8*kcBO1!EJ*FqwWh6Yb`HaU5Oa@qYq2}A? z=?enDW`shqb3{si)OU0LdcL(}CW9@9>%)KEE2!Z}`qS^`R&dlU4;?-r#ZHQR$DUq4 z#U#12b$c9I!1MGL=q_n~AA~3;@u$!Fhk|RN3K6A`{^o7-pH@1-uRra^O*3cFsy!uF zP}h%=yK`=}&%rHvt^0bd3wpW#TL3o;Tk>A~U6;$SzC{=xQuHrLbT!T%MHAGzdh~vd z|5o1E9=k8^DkmD~X4-kq|3~OtJ5=Q|>th_CCFZ$+iB?O=!lCCl<9)rU%BUQv>~Vv0 z{G{&y*0Yv5J#VPPa~m*22oNDs(qgkl6eL2ZpXDR~+=#~~Po*m%b(j7Sa0dyqW0}uS z2N}`SfFxi77C}~{sz8cEm;P!mYlg-g^wl!#Gk6+2uh^e6(+GQ)<7aaLy3Kb#1Re#0 zRTSo_7iBzqk8FY$AkzpVa`wc!1yZ6idXr%F012ayRm;c-$J|E#A>a%GMcidI5eJUu z@6`YdkVpdxNEA7P0gK?s;{mGM4|Ff1qfZ#7cHv5AMgh@lJ}5y(haXtJlVC*I&{V6u z^niA6>va|tyP}aLK#KBBz88o`3KvHgLc#q-Rh4NF4;UFU95 z&C=H-MGCh5xZ8&+yZ+Z^hgL&>a^{|X+f@R9R3|~nq_!q1uIJ-A0rn`(g5FZ?EYI!a z;%A}xKiMh>q>hKCLzm_?32WqHZ-pH%5U~k} z7$V{*<_?8`-C~}Hm%pitJjhyq8_W$oL>dLdnDDJUoObAQzINzC8~dwTw(Qn%Q3Fom zJWzjo{QdNMg^!aW)&1b&ukxrIFz6-^T@Tm9+&APq1Ko%A+efRU;&3Dy(zi?|)Z80% zCv+NSyt})(dUfopavfpu!m7q+N$-+0tZ)!c} zmWGeVS9aN3xrx>bA*58}4C-JG5X3BglxOC0R9bIWA1#45!-1vd8r*bfg1NRPMk3Fb z#y>x!`$c!QLG;?dN&KOGGb{|goLRTC$hKy5n_od;hvTcG$8TCW$<2&k-LEroKPcavs6YCs$n!7#Tn+lFDG*6(i4~ zcX%6mOu4UMY#uq**SVh3XHS@*U-`jQX^fl_&7YS16Rlyb07Nv=F@z%jyp;s!e*q3`#j)zOw+H@QEzr|H>()BnysWV zU#;h~wy#kUo6KIz2q&KX-OwWcT0`?Q8kMk*Og`h)aGfhFu%y}4;^f4p_z?tqMk_f| zI6oUH_!iL!@Zc0u)Ch(4xC2@%ImcBqz(${PZamr@jwL06P!H1?eNR66Wf|8rg`gUT z*Y~2L=SdJ!i1d^E79>(%;6O9hA3bTV!;eO?RIy@WDOOC-rA4X}vL<8yraL@JuLq4N zNXG$ab09T)TmYe1MPmv% zY2zx}73g~ZRo{@?zA4>{Up
-
+

Name

@@ -49,24 +48,19 @@

Synopsis

arpaname {ipaddress ...}

-
-

DESCRIPTION

+
+

DESCRIPTION

- arpaname translates IP addresses (IPv4 and + arpaname translates IP addresses (IPv4 and IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.

-
-

SEE ALSO

+
+

SEE ALSO

BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -87,6 +81,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.ddns-confgen.html b/contrib/bind9/doc/arm/man.ddns-confgen.html index aef19fe48..3b2f7e472 100644 --- a/contrib/bind9/doc/arm/man.ddns-confgen.html +++ b/contrib/bind9/doc/arm/man.ddns-confgen.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - ddns-confgen - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,36 +48,36 @@

Synopsis

ddns-confgen [-a algorithm] [-h] [-k keyname] [-r randomfile] [ -s name | -z zone ] [-q] [name]

-
-

DESCRIPTION

-

ddns-confgen - generates a key for use by nsupdate - and named. It simplifies configuration +

+

DESCRIPTION

+

ddns-confgen + generates a key for use by nsupdate + and named. It simplifies configuration of dynamic zones by generating a key and providing the - nsupdate and named.conf + nsupdate and named.conf syntax that will be needed to use it, including an example - update-policy statement. + update-policy statement.

If a domain name is specified on the command line, it will be used in the name of the generated key and in the sample - named.conf syntax. For example, - ddns-confgen example.com would + named.conf syntax. For example, + ddns-confgen example.com would generate a key called "ddns-key.example.com", and sample - named.conf command that could be used + named.conf command that could be used in the zone definition for "example.com".

- Note that named itself can configure a - local DDNS key for use with nsupdate -l. - ddns-confgen is only needed when a + Note that named itself can configure a + local DDNS key for use with nsupdate -l. + ddns-confgen is only needed when a more elaborate configuration is required: for instance, if - nsupdate is to be used from a remote system. + nsupdate is to be used from a remote system.

-
-

OPTIONS

-
+
+

OPTIONS

+
-a algorithm

Specifies the algorithm to use for the TSIG key. Available @@ -88,7 +87,7 @@

-h

Prints a short summary of the options and arguments to - ddns-confgen. + ddns-confgen.

-k keyname

@@ -121,7 +120,7 @@

-s name

- Single host mode: The example named.conf text + Single host mode: The example named.conf text shows how to set an update policy for the specified name using the "name" nametype. @@ -133,7 +132,7 @@

-z zone

- zone mode: The example named.conf text + zone mode: The example named.conf text shows how to set an update policy for the specified zone using the "zonesub" nametype, allowing updates to all subdomain @@ -143,19 +142,14 @@

-
-

SEE ALSO

+
+

SEE ALSO

nsupdate(1), named.conf(5), named(8), BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -176,6 +170,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.dig.html b/contrib/bind9/doc/arm/man.dig.html index 44cc60bbe..25496707a 100644 --- a/contrib/bind9/doc/arm/man.dig.html +++ b/contrib/bind9/doc/arm/man.dig.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dig - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -51,41 +50,41 @@

dig [-h]

dig [global-queryopt...] [query...]

-
-

DESCRIPTION

-

dig +

+

DESCRIPTION

+

dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that - were queried. Most DNS administrators use dig to + were queried. Most DNS administrators use dig to troubleshoot DNS problems because of its flexibility, ease of use and clarity of output. Other lookup tools tend to have less functionality - than dig. + than dig.

- Although dig is normally used with + Although dig is normally used with command-line arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command-line arguments and options is printed when the -h option is given. Unlike earlier versions, the BIND 9 implementation of - dig allows multiple lookups to be issued + dig allows multiple lookups to be issued from the command line.

Unless it is told to query a specific name server, - dig will try each of the servers listed in + dig will try each of the servers listed in /etc/resolv.conf. If no usable server addresses - are found, dig will send the query to the local + are found, dig will send the query to the local host.

When no command line arguments or options are given, - dig will perform an NS query for "." (the root). + dig will perform an NS query for "." (the root).

- It is possible to set per-user defaults for dig via + It is possible to set per-user defaults for dig via ${HOME}/.digrc. This file is read and any options in it are applied before the command line arguments. @@ -93,22 +92,22 @@

The IN and CH class names overlap with the IN and CH top level domain names. Either use the -t and - -c options to specify the type and class, + -c options to specify the type and class, use the -q the specify the domain name, or use "IN." and "CH." when looking up these top level domains.

-
-

SIMPLE USAGE

+
+

SIMPLE USAGE

- A typical invocation of dig looks like: + A typical invocation of dig looks like: 

 dig @server name type

where:

-
+
server

@@ -116,19 +115,19 @@ can be an IPv4 address in dotted-decimal notation or an IPv6 address in colon-delimited notation. When the supplied server argument is a hostname, - dig resolves that name before querying + dig resolves that name before querying that name server.

If no server argument is - provided, dig consults + provided, dig consults /etc/resolv.conf; if an address is found there, it queries the name server at that address. If either of the -4 or -6 options are in use, then only addresses for the corresponding transport will be tried. If no usable addresses are found, - dig will send the query to the + dig will send the query to the local host. The reply from the name server that responds is displayed.

@@ -144,16 +143,16 @@ type can be any valid query type. If no type argument is supplied, - dig will perform a lookup for an + dig will perform a lookup for an A record.

-
-

OPTIONS

-
+
+

OPTIONS

+
-4

Use IPv4 only. @@ -177,12 +176,12 @@

-f file

- Batch mode: dig reads a list of lookup + Batch mode: dig reads a list of lookup requests to process from the given file. Each line in the file should be organized in the same way they would be presented as queries to - dig using the command-line interface. + dig using the command-line interface.

-i

@@ -195,11 +194,11 @@ Sign queries using TSIG using a key read from the given file. Key files can be generated using tsig-keygen(8). - When using TSIG authentication with dig, + When using TSIG authentication with dig, the name server that is queried needs to know the key and algorithm that is being used. In BIND, this is done by - providing appropriate key - and server statements in + providing appropriate key + and server statements in named.conf.

-m
@@ -246,7 +245,7 @@ need to provide the name, class and type - arguments. dig automatically performs a + arguments. dig automatically performs a lookup for a name like 94.2.0.192.in-addr.arpa and sets the query type and class to PTR and IN respectively. IPv6 @@ -279,9 +278,9 @@
-
-

QUERY OPTIONS

-

dig +

+

QUERY OPTIONS

+

dig provides a number of query options which affect the way in which lookups are made and the results displayed. Some of these set or reset flag bits in the query header, some determine which @@ -302,7 +301,7 @@ The query options are:

-
+
+[no]aaflag

A synonym for +[no]aaonly. @@ -371,7 +370,7 @@

+[no]cmd

Toggles the printing of the initial comment in the - output identifying the version of dig + output identifying the version of dig and the query options that have been applied. This comment is printed by default.

@@ -395,7 +394,7 @@

Set the search list to contain the single domain somename, as if specified in - a domain directive in + a domain directive in /etc/resolv.conf, and enable search list processing as if the +search option were given. @@ -439,7 +438,7 @@ Print records like the SOA records in a verbose multi-line format with human-readable comments. The default is to print each record on a single line, to - facilitate machine parsing of the dig + facilitate machine parsing of the dig output.

+ndots=D
@@ -463,7 +462,7 @@

+[no]nssearch

- When this option is set, dig + When this option is set, dig attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for @@ -494,7 +493,7 @@

Toggle the setting of the RD (recursion desired) bit in the query. This bit is set by default, which means - dig normally sends recursive + dig normally sends recursive queries. Recursion is automatically disabled when the +nssearch or +trace query options are used. @@ -591,7 +590,7 @@ Toggle tracing of the delegation path from the root name servers for the name being looked up. Tracing is disabled by default. When tracing is enabled, - dig makes iterative queries to + dig makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup. @@ -601,7 +600,7 @@ initial query for the root zone name servers.

- +dnssec is also set when +trace + +dnssec is also set when +trace is set to better emulate the default queries from a nameserver.

@@ -622,7 +621,7 @@ must be on its own line.

- If not specified, dig will look + If not specified, dig will look for /etc/trusted-key.key then trusted-key.key in the current directory. @@ -648,10 +647,10 @@

-
-

MULTIPLE QUERIES

+
+

MULTIPLE QUERIES

- The BIND 9 implementation of dig + The BIND 9 implementation of dig supports specifying multiple queries on the command line (in addition to supporting the -f batch file option). Each of those @@ -678,7 +677,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr

- shows how dig could be used from the + shows how dig could be used from the command line to make three lookups: an ANY query for www.isc.org, a reverse lookup of 127.0.0.1 and a query for the NS records of @@ -686,45 +685,45 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr A global query option of +qr is applied, so - that dig shows the initial query it made + that dig shows the initial query it made for each lookup. The final query has a local query option of - +noqr which means that dig + +noqr which means that dig will not print the initial query when it looks up the NS records for isc.org.

-
-

IDN SUPPORT

+
+

IDN SUPPORT

- If dig has been built with IDN (internationalized + If dig has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. - dig appropriately converts character encoding of + dig appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server. If you'd like to turn off the IDN support for some reason, defines the IDN_DISABLE environment variable. - The IDN support is disabled if the variable is set when - dig runs. + The IDN support is disabled if the variable is set when + dig runs.

-
-

FILES

+
+

FILES

/etc/resolv.conf

${HOME}/.digrc

-
-

SEE ALSO

+
+

SEE ALSO

host(1), named(8), dnssec-keygen(8), RFC1035.

-
-

BUGS

+
+

BUGS

There are probably too many query options.

@@ -747,6 +746,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.dnssec-checkds.html b/contrib/bind9/doc/arm/man.dnssec-checkds.html index 9965a076d..c11e1b4f2 100644 --- a/contrib/bind9/doc/arm/man.dnssec-checkds.html +++ b/contrib/bind9/doc/arm/man.dnssec-checkds.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dnssec-checkds - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -50,17 +49,17 @@

dnssec-checkds [-l domain] [-f file] [-d dig path] [-D dsfromkey path] {zone}

dnssec-dsfromkey [-l domain] [-f file] [-d dig path] [-D dsfromkey path] {zone}

-
-

DESCRIPTION

-

dnssec-checkds +

+

DESCRIPTION

+

dnssec-checkds verifies the correctness of Delegation Signer (DS) or DNSSEC Lookaside Validation (DLV) resource records for keys in a specified zone.

-
-

OPTIONS

-
+
+

OPTIONS

+
-f file

If a file is specified, then the zone is @@ -69,36 +68,31 @@

-l domain

- Check for a DLV record in the specified lookaside domain, + Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone's parent. For example, to check for DLV records for "example.com" in ISC's DLV zone, use: - dnssec-checkds -l dlv.isc.org example.com + dnssec-checkds -l dlv.isc.org example.com

-d dig path

- Specifies a path to a dig binary. Used + Specifies a path to a dig binary. Used for testing.

-D dsfromkey path

- Specifies a path to a dnssec-dsfromkey binary. + Specifies a path to a dnssec-dsfromkey binary. Used for testing.

-
-

SEE ALSO

+
+

SEE ALSO

dnssec-dsfromkey(8), dnssec-keygen(8), dnssec-signzone(8),

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -118,6 +112,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.dnssec-coverage.html b/contrib/bind9/doc/arm/man.dnssec-coverage.html index 7ecaed3c6..6cd24c947 100644 --- a/contrib/bind9/doc/arm/man.dnssec-coverage.html +++ b/contrib/bind9/doc/arm/man.dnssec-coverage.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dnssec-coverage - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,9 +48,9 @@

Synopsis

dnssec-coverage [-K directory] [-f file] [-d DNSKEY TTL] [-m max TTL] [-r interval] [-c compilezone path] [zone]

-
-

DESCRIPTION

-

dnssec-coverage +

+

DESCRIPTION

+

dnssec-coverage verifies that the DNSSEC keys for a given zone or a set of zones have timing metadata set properly to ensure no future lapses in DNSSEC coverage. @@ -77,9 +76,9 @@ share the same TTL parameters.)

-
-

OPTIONS

-
+
+

OPTIONS

+
-f file

If a file is specified, then the zone is @@ -137,7 +136,7 @@ This option is mandatory unless the -f has been used to specify a zone file, or a default key TTL was set with the -L to - dnssec-keygen. (If either of those is true, + dnssec-keygen. (If either of those is true, this option may still be used; it will override the value found in the zone or key file.)

@@ -149,7 +148,7 @@ or zones being analyzed when determining whether there is a possibility of validation failure. This value defaults to 22.5 days, which is also the default in - named. However, if it has been changed + named. However, if it has been changed by the sig-validity-interval option in named.conf, then it should also be changed here. @@ -162,13 +161,13 @@
-c compilezone path

- Specifies a path to a named-compilezone binary. + Specifies a path to a named-compilezone binary. Used for testing.

-
-

SEE ALSO

+
+

SEE ALSO

dnssec-checkds(8), dnssec-dsfromkey(8), @@ -176,11 +175,6 @@ dnssec-signzone(8)

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -201,6 +195,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.dnssec-dsfromkey.html b/contrib/bind9/doc/arm/man.dnssec-dsfromkey.html index 46425f9fb..c4006a824 100644 --- a/contrib/bind9/doc/arm/man.dnssec-dsfromkey.html +++ b/contrib/bind9/doc/arm/man.dnssec-dsfromkey.html @@ -14,16 +14,15 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dnssec-dsfromkey - - + + - +
@@ -33,13 +32,13 @@ Prev  Manual pages - Next + Next
-
+

Name

@@ -51,16 +50,16 @@

dnssec-dsfromkey {-s} [-1] [-2] [-a alg] [-K directory] [-l domain] [-s] [-c class] [-T TTL] [-f file] [-A] [-v level] {dnsname}

dnssec-dsfromkey [-h] [-V]

-
-

DESCRIPTION

-

dnssec-dsfromkey +

+

DESCRIPTION

+

dnssec-dsfromkey outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s).

-
-

OPTIONS

-
+
+

OPTIONS

+
-1

Use SHA-1 as the digest algorithm (the default is to use @@ -103,7 +102,7 @@

If file is set to "-", then the zone data is read from the standard input. This makes it - possible to use the output of the dig + possible to use the output of the dig command as input, as in:

@@ -114,7 +113,7 @@

Include ZSK's when generating DS records. Without this option, only keys which have the KSK flag set will be converted to DS - records and printed. Useful only in zone file mode. + records and printed. Useful only in zone file mode.

-l domain

@@ -149,8 +148,8 @@

-
-

EXAMPLE

+
+

EXAMPLE

To build the SHA-256 DS RR from the Kexample.com.+003+26160 @@ -164,8 +163,8 @@

example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94

-
-

FILES

+
+

FILES

The keyfile can be designed by the key identification Knnnn.+aaa+iiiii or the full file name @@ -178,14 +177,14 @@ dnsname.

-
-

CAVEAT

+
+

CAVEAT

A keyfile error can give a "file not found" even if the file exists.

-
-

SEE ALSO

+
+

SEE ALSO

dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, @@ -194,11 +193,6 @@ RFC 4509.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -207,18 +201,18 @@ Prev  Up - Next + Next dnssec-coverage  Home - dnssec-keyfromlabel + dnssec-importkey
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.dnssec-importkey.html b/contrib/bind9/doc/arm/man.dnssec-importkey.html new file mode 100644 index 000000000..f24553ed4 --- /dev/null +++ b/contrib/bind9/doc/arm/man.dnssec-importkey.html @@ -0,0 +1,182 @@ + + + + +dnssec-importkey + + + + + + + +
+ + + + + + + +
dnssec-importkey
+Prev Manual pages Next +
+
+
+
+
+
+

Name

+

dnssec-importkey — Import DNSKEY records from external systems so they can be managed.

+
+
+

Synopsis

+

dnssec-importkey [-K directory] [-L ttl] [-P date/offset] [-D date/offset] [-h] [-v level] [-V] {keyfile}

+

dnssec-importkey {-f filename} [-K directory] [-L ttl] [-P date/offset] [-D date/offset] [-h] [-v level] [-V] [dnsname]

+
+
+

DESCRIPTION

+

dnssec-importkey + reads a public DNSKEY record and generates a pair of + .key/.private files. The DNSKEY record may be read from an + existing .key file, in which case a corresponding .private file + will be generated, or it may be read from any other file or + from the standard input, in which case both .key and .private + files will be generated. +

+

+ The newly-created .private file does not + contain private key data, and cannot be used for signing. + However, having a .private file makes it possible to set + publication (-P) and deletion + (-D) times for the key, which means the + public key can be added to and removed from the DNSKEY RRset + on schedule even if the true private key is stored offline. +

+
+
+

OPTIONS

+
+
-f filename
+
+

+ Zone file mode: instead of a public keyfile name, the argument + is the DNS domain name of a zone master file, which can be read + from file. If the domain name is the same as + file, then it may be omitted. +

+

+ If file is set to "-", then + the zone data is read from the standard input. +

+
+
-K directory
+

+ Sets the directory in which the key files are to reside. +

+
-L ttl
+

+ Sets the default TTL to use for this key when it is converted + into a DNSKEY RR. If the key is imported into a zone, + this is the TTL that will be used for it, unless there was + already a DNSKEY RRset in place, in which case the existing TTL + would take precedence. Setting the default TTL to + 0 or none removes it. +

+
-h
+

+ Emit usage message and exit. +

+
-v level
+

+ Sets the debugging level. +

+
-V
+

+ Prints version information. +

+
+
+
+

TIMING OPTIONS

+

+ Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. + If the argument begins with a '+' or '-', it is interpreted as + an offset from the present time. For convenience, if such an offset + is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', + then the offset is computed in years (defined as 365 24-hour days, + ignoring leap years), months (defined as 30 24-hour days), weeks, + days, hours, or minutes, respectively. Without a suffix, the offset + is computed in seconds. To explicitly prevent a date from being + set, use 'none' or 'never'. +

+
+
-P date/offset
+

+ Sets the date on which a key is to be published to the zone. + After that date, the key will be included in the zone but will + not be used to sign it. +

+
-D date/offset
+

+ Sets the date on which the key is to be deleted. After that + date, the key will no longer be included in the zone. (It + may remain in the key repository, however.) +

+
+
+
+

FILES

+

+ A keyfile can be designed by the key identification + Knnnn.+aaa+iiiii or the full file name + Knnnn.+aaa+iiiii.key as generated by + dnssec-keygen(8). +

+
+
+

SEE ALSO

+

dnssec-keygen(8), + dnssec-signzone(8), + BIND 9 Administrator Reference Manual, + RFC 5011. +

+
+
+
+
+ + + + + + + + + + + +
+Prev Up Next +
+dnssec-dsfromkey Home dnssec-keyfromlabel +
+
+

BIND 9.9.9-P3 (Extended Support Version)

+ + diff --git a/contrib/bind9/doc/arm/man.dnssec-keyfromlabel.html b/contrib/bind9/doc/arm/man.dnssec-keyfromlabel.html index 535b8c3be..8931f8d21 100644 --- a/contrib/bind9/doc/arm/man.dnssec-keyfromlabel.html +++ b/contrib/bind9/doc/arm/man.dnssec-keyfromlabel.html @@ -14,15 +14,14 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dnssec-keyfromlabel - - + + - + @@ -31,7 +30,7 @@ dnssec-keyfromlabel -Prev  +Prev  Manual pages  Next @@ -39,7 +38,7 @@
-
+

Name

@@ -49,13 +48,13 @@

Synopsis

dnssec-keyfromlabel {-l label} [-3] [-a algorithm] [-A date/offset] [-c class] [-D date/offset] [-E engine] [-f flag] [-G] [-I date/offset] [-i interval] [-k] [-K directory] [-L ttl] [-n nametype] [-P date/offset] [-p protocol] [-R date/offset] [-S key] [-t type] [-v level] [-V] [-y] {name}

-
-

DESCRIPTION

-

dnssec-keyfromlabel +

+

DESCRIPTION

+

dnssec-keyfromlabel generates a key pair of files that referencing a key object stored in a cryptographic hardware service module (HSM). The private key file can be used for DNSSEC signing of zone data as if it were a - conventional signing key created by dnssec-keygen, + conventional signing key created by dnssec-keygen, but the key material is stored within the HSM, and the actual signing takes place there.

@@ -65,9 +64,9 @@ being generated.

-
-

OPTIONS

-
+
+

OPTIONS

+
-a algorithm

@@ -122,7 +121,7 @@

-C

Compatibility mode: generates an old-style key, without - any metadata. By default, dnssec-keyfromlabel + any metadata. By default, dnssec-keyfromlabel will include the key's creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc). Keys that include @@ -147,7 +146,7 @@

-h

Prints a short summary of the options and arguments to - dnssec-keyfromlabel. + dnssec-keyfromlabel.

-K directory

@@ -208,8 +207,8 @@

-
-

TIMING OPTIONS

+
+

TIMING OPTIONS

Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -221,7 +220,7 @@ is computed in seconds. To explicitly prevent a date from being set, use 'none' or 'never'.

-
+
-P date/offset

Sets the date on which a key is to be published to the zone. @@ -267,7 +266,7 @@

If the key is being created as an explicit successor to another - key, then the default prepublication interval is 30 days; + key, then the default prepublication interval is 30 days; otherwise it is zero.

@@ -280,26 +279,26 @@

-
-

GENERATED KEY FILES

+
+

GENERATED KEY FILES

- When dnssec-keyfromlabel completes + When dnssec-keyfromlabel completes successfully, it prints a string of the form Knnnn.+aaa+iiiii to the standard output. This is an identification string for the key files it has generated.

-
    -

  • nnnn is the key name. +

      +

    • nnnn is the key name.

      • -

    • aaa is the numeric representation +

    • aaa is the numeric representation of the algorithm.

      • -

    • iiiii is the key identifier (or +

    • iiiii is the key identifier (or footprint).

    -

    dnssec-keyfromlabel +

    dnssec-keyfromlabel creates two files, with names based on the printed string. Knnnn.+aaa+iiiii.key contains the public key, and @@ -319,39 +318,34 @@ general read permission.

-
-

SEE ALSO

+
+

SEE ALSO

dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 4034.

-
-

AUTHOR

-

Internet Systems Consortium -

-
+Prev  +dnssec-importkey 
-Prev  Up  Next
-dnssec-dsfromkey  Home  dnssec-keygen
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.dnssec-keygen.html b/contrib/bind9/doc/arm/man.dnssec-keygen.html index d3252e941..dd46bf33e 100644 --- a/contrib/bind9/doc/arm/man.dnssec-keygen.html +++ b/contrib/bind9/doc/arm/man.dnssec-keygen.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dnssec-keygen - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,9 +48,9 @@

Synopsis

dnssec-keygen [-a algorithm] [-b keysize] [-n nametype] [-3] [-A date/offset] [-C] [-c class] [-D date/offset] [-E engine] [-f flag] [-G] [-g generator] [-h] [-I date/offset] [-i interval] [-K directory] [-L ttl] [-k] [-P date/offset] [-p protocol] [-q] [-R date/offset] [-r randomdev] [-S key] [-s strength] [-t type] [-v level] [-V] [-z] {name}

-
-

DESCRIPTION

-

dnssec-keygen +

+

DESCRIPTION

+

dnssec-keygen generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY @@ -63,9 +62,9 @@ which the key is being generated.

-
-

OPTIONS

-
+
+

OPTIONS

+
-a algorithm

@@ -138,7 +137,7 @@

-C

Compatibility mode: generates an old-style key, without - any metadata. By default, dnssec-keygen + any metadata. By default, dnssec-keygen will include the key's creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc). Keys that include @@ -177,7 +176,7 @@

-h

Prints a short summary of the options and arguments to - dnssec-keygen. + dnssec-keygen.

-K directory

@@ -209,7 +208,7 @@

Quiet mode: Suppresses unnecessary output, including progress indication. Without this option, when - dnssec-keygen is run interactively + dnssec-keygen is run interactively to generate an RSA or DSA key pair, it will print a string of symbols to stderr indicating the progress of the key generation. A '.' indicates that a @@ -279,8 +278,8 @@

-
-

TIMING OPTIONS

+
+

TIMING OPTIONS

Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -292,7 +291,7 @@ is computed in seconds. To explicitly prevent a date from being set, use 'none' or 'never'.

-
+
-P date/offset

Sets the date on which a key is to be published to the zone. @@ -340,7 +339,7 @@

If the key is being created as an explicit successor to another - key, then the default prepublication interval is 30 days; + key, then the default prepublication interval is 30 days; otherwise it is zero.

@@ -353,27 +352,27 @@

-
-

GENERATED KEYS

+
+

GENERATED KEYS

- When dnssec-keygen completes + When dnssec-keygen completes successfully, it prints a string of the form Knnnn.+aaa+iiiii to the standard output. This is an identification string for the key it has generated.

-
    -

  • nnnn is the key name. +

      +

    • nnnn is the key name.

      • -

    • aaa is the numeric representation +

    • aaa is the numeric representation of the algorithm.

      • -

    • iiiii is the key identifier (or +

    • iiiii is the key identifier (or footprint).

    -

    dnssec-keygen +

    dnssec-keygen creates two files, with names based on the printed string. Knnnn.+aaa+iiiii.key contains the public key, and @@ -399,8 +398,8 @@ HMAC-MD5, even though the public and private key are equivalent.

-
-

EXAMPLE

+
+

EXAMPLE

To generate a 768-bit DSA key for the domain example.com, the following command would be @@ -414,14 +413,14 @@

Kexample.com.+003+26160

- In this example, dnssec-keygen creates + In this example, dnssec-keygen creates the files Kexample.com.+003+26160.key and Kexample.com.+003+26160.private.

-
-

SEE ALSO

+
+

SEE ALSO

dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 2539, @@ -429,11 +428,6 @@ RFC 4034.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -454,6 +448,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.dnssec-revoke.html b/contrib/bind9/doc/arm/man.dnssec-revoke.html index 43c5ad091..2adbbb403 100644 --- a/contrib/bind9/doc/arm/man.dnssec-revoke.html +++ b/contrib/bind9/doc/arm/man.dnssec-revoke.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dnssec-revoke - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,17 +48,17 @@

Synopsis

dnssec-revoke [-hr] [-v level] [-V] [-K directory] [-E engine] [-f] [-R] {keyfile}

-
-

DESCRIPTION

-

dnssec-revoke +

+

DESCRIPTION

+

dnssec-revoke reads a DNSSEC key file, sets the REVOKED bit on the key as defined in RFC 5011, and creates a new pair of key files containing the now-revoked key.

-
-

OPTIONS

-
+
+

OPTIONS

+
-h

Emit usage message and exit. @@ -88,7 +87,7 @@

-f

- Force overwrite: Causes dnssec-revoke to + Force overwrite: Causes dnssec-revoke to write the new key pair even if a file already exists matching the algorithm and key ID of the revoked key.

@@ -99,18 +98,13 @@

-
-

SEE ALSO

+
+

SEE ALSO

dnssec-keygen(8), BIND 9 Administrator Reference Manual, RFC 5011.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -131,6 +125,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.dnssec-settime.html b/contrib/bind9/doc/arm/man.dnssec-settime.html index fd4fa7c3b..2d4afe24a 100644 --- a/contrib/bind9/doc/arm/man.dnssec-settime.html +++ b/contrib/bind9/doc/arm/man.dnssec-settime.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dnssec-settime - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,20 +48,20 @@

Synopsis

dnssec-settime [-f] [-K directory] [-L ttl] [-P date/offset] [-A date/offset] [-R date/offset] [-I date/offset] [-D date/offset] [-h] [-V] [-v level] [-E engine] {keyfile}

-
-

DESCRIPTION

-

dnssec-settime +

+

DESCRIPTION

+

dnssec-settime reads a DNSSEC private key file and sets the key timing metadata as specified by the -P, -A, -R, -I, and -D options. The metadata can then be used by - dnssec-signzone or other signing software to + dnssec-signzone or other signing software to determine when a key is to be published, whether it should be used for signing a zone, etc.

If none of these options is set on the command line, - then dnssec-settime simply prints the key timing + then dnssec-settime simply prints the key timing metadata already stored in the key.

@@ -75,18 +74,18 @@ inaccessible to anyone other than the owner (mode 0600).

-
-

OPTIONS

-
+
+

OPTIONS

+
-f

Force an update of an old-format key with no metadata fields. - Without this option, dnssec-settime will + Without this option, dnssec-settime will fail when attempting to update a legacy key. With this option, the key will be recreated in the new format, but with the original key data retained. The key's creation date will be - set to the present time. If no other values are specified, - then the key's publication and activation dates will also + set to the present time. If no other values are specified, + then the key's publication and activation dates will also be set to the present time.

-K directory
@@ -123,8 +122,8 @@

-
-

TIMING OPTIONS

+
+

TIMING OPTIONS

Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -135,7 +134,7 @@ days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds. To unset a date, use 'none' or 'never'.

-
+
-P date/offset

Sets the date on which a key is to be published to the zone. @@ -189,7 +188,7 @@

If the key is being set to be an explicit successor to another - key, then the default prepublication interval is 30 days; + key, then the default prepublication interval is 30 days; otherwise it is zero.

@@ -202,13 +201,13 @@

-
-

PRINTING OPTIONS

+
+

PRINTING OPTIONS

- dnssec-settime can also be used to print the + dnssec-settime can also be used to print the timing metadata associated with a key.

-
+
-u

Print times in UNIX epoch format. @@ -228,19 +227,14 @@

-
-

SEE ALSO

+
+

SEE ALSO

dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 5011.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -261,6 +255,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.dnssec-signzone.html b/contrib/bind9/doc/arm/man.dnssec-signzone.html index 489b0c7a6..0a387d41f 100644 --- a/contrib/bind9/doc/arm/man.dnssec-signzone.html +++ b/contrib/bind9/doc/arm/man.dnssec-signzone.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dnssec-signzone - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,9 +48,9 @@

Synopsis

dnssec-signzone [-a] [-c class] [-d directory] [-D] [-E engine] [-e end-time] [-f output-file] [-g] [-h] [-K directory] [-k key] [-L serial] [-l domain] [-i interval] [-I input-format] [-j jitter] [-N soa-serial-format] [-o origin] [-O output-format] [-P] [-p] [-R] [-r randomdev] [-S] [-s start-time] [-T ttl] [-t] [-u] [-v level] [-V] [-X extended end-time] [-x] [-z] [-3 salt] [-H iterations] [-A] {zonefile} [key...]

-
-

DESCRIPTION

-

dnssec-signzone +

+

DESCRIPTION

+

dnssec-signzone signs a zone. It generates NSEC and RRSIG records and produces a signed version of the zone. The security status of delegations from the signed zone @@ -60,9 +59,9 @@ keyset file for each child zone.

-
-

OPTIONS

-
+
+

OPTIONS

+
-a

Verify all generated signatures. @@ -78,7 +77,7 @@ file in addition to dsset-zonename when signing a zone, for use by older versions of - dnssec-signzone. + dnssec-signzone.

-d directory

@@ -88,11 +87,11 @@

-D

Output only those record types automatically managed by - dnssec-signzone, i.e. RRSIG, NSEC, + dnssec-signzone, i.e. RRSIG, NSEC, NSEC3 and NSEC3PARAM records. If smart signing (-S) is used, DNSKEY records are also included. The resulting file can be included in the original - zone file with $INCLUDE. This option + zone file with $INCLUDE. This option cannot be combined with -O raw or serial number updating.

@@ -181,7 +180,7 @@
-h

Prints a short summary of the options and arguments to - dnssec-signzone. + dnssec-signzone.

-V

@@ -201,7 +200,7 @@ The default cycle interval is one quarter of the difference between the signature end and start times. So if neither end-time or start-time - are specified, dnssec-signzone + are specified, dnssec-signzone generates signatures that are valid for 30 days, with a cycle interval of 7.5 days. Therefore, if any existing RRSIG records @@ -212,8 +211,8 @@

-I input-format

The format of the input zone file. - Possible formats are "text" (default) - and "raw". + Possible formats are "text" (default) + and "raw". This option is primarily intended to be used for dynamic signed zones so that the dumped zone file in a non-text format containing updates can be signed directly. @@ -243,7 +242,7 @@

-L serial

- When writing a signed zone to 'raw' format, set the "source serial" + When writing a signed zone to 'raw' format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.)

@@ -256,17 +255,17 @@

The SOA serial number format of the signed zone. - Possible formats are "keep" (default), - "increment" and - "unixtime". + Possible formats are "keep" (default), + "increment" and + "unixtime".

-
-
"keep"
+
+
"keep"

Do not modify the SOA serial number.

-
"increment"
+
"increment"

Increment the SOA serial number using RFC 1982 arithmetics.

-
"unixtime"
+
"unixtime"

Set the SOA serial number to the number of seconds since epoch.

@@ -279,15 +278,15 @@
-O output-format

The format of the output file containing the signed zone. - Possible formats are "text" (default) - "full", which is text output in a + Possible formats are "text" (default) + "full", which is text output in a format suitable for processing by external scripts, - and "raw" or "raw=N", + and "raw" or "raw=N", which store the zone in a binary format for rapid loading - by named. "raw=N" + by named. "raw=N" specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of - named; if N is 1, the file can be + named; if N is 1, the file can be read by release 9.9.0 or higher. The default is 1.

-p
@@ -318,11 +317,11 @@

Normally, when a previously-signed zone is passed as input to the signer, and a DNSKEY record has been removed and - replaced with a new one, signatures from the old key + replaced with a new one, signatures from the old key that are still within their validity period are retained. This allows the zone to continue to validate with cached copies of the old DNSKEY RRset. The -Q - forces dnssec-signzone to remove + forces dnssec-signzone to remove signatures from keys that are no longer active. This enables ZSK rollover using the procedure described in RFC 4641, section 4.2.1.1 ("Pre-Publish Key Rollover"). @@ -335,7 +334,7 @@

This option is similar to -Q, except it - forces dnssec-signzone to signatures from + forces dnssec-signzone to signatures from keys that are no longer published. This enables ZSK rollover using the procedure described in RFC 4641, section 4.2.1.2 ("Double Signature Zone Signing Key Rollover"). @@ -356,7 +355,7 @@

-S

- Smart signing: Instructs dnssec-signzone to + Smart signing: Instructs dnssec-signzone to search the key repository for keys that match the zone being signed, and to include them in the zone if appropriate.

@@ -366,7 +365,7 @@ rules. Each successive rule takes priority over the prior ones:

-
+

If no timing metadata has been set for the key, the key is @@ -381,7 +380,7 @@

If the key's activation date is set and in the past, the key is published (regardless of publication date) and - used to sign the zone. + used to sign the zone.

@@ -421,7 +420,7 @@ zone. With this option, a zone signed with NSEC can be switched to NSEC3, or a zone signed with NSEC3 can be switch to NSEC or to NSEC3 with different parameters. - Without this option, dnssec-signzone will + Without this option, dnssec-signzone will retain the existing chain when re-signing.

-v level
@@ -432,16 +431,16 @@

Only sign the DNSKEY RRset with key-signing keys, and omit signatures from zone-signing keys. (This is similar to the - dnssec-dnskey-kskonly yes; zone option in - named.) + dnssec-dnskey-kskonly yes; zone option in + named.)

-z

Ignore KSK flag on key when determining what to sign. This causes KSK-flagged keys to sign all records, not just the DNSKEY RRset. (This is similar to the - update-check-ksk no; zone option in - named.) + update-check-ksk no; zone option in + named.)

-3 salt

@@ -482,23 +481,23 @@

-
-

EXAMPLE

+
+

EXAMPLE

The following command signs the example.com - zone with the DSA key generated by dnssec-keygen - (Kexample.com.+003+17247). Because the -S option + zone with the DSA key generated by dnssec-keygen + (Kexample.com.+003+17247). Because the -S option is not being used, the zone's keys must be in the master file (db.example.com). This invocation looks for dsset files, in the current directory, - so that DS records can be imported from them (-g). + so that DS records can be imported from them (-g). 

% dnssec-signzone -g -o example.com db.example.com \
 Kexample.com.+003+17247
 db.example.com.signed
 %

- In the above example, dnssec-signzone creates + In the above example, dnssec-signzone creates the file db.example.com.signed. This file should be referenced in a zone statement in a named.conf file. @@ -512,18 +511,13 @@ db.example.com.signed db.example.com.signed %

-
-

SEE ALSO

+
+

SEE ALSO

dnssec-keygen(8), BIND 9 Administrator Reference Manual, RFC 4033, RFC 4641.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -544,6 +538,6 @@ db.example.com.signed
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.dnssec-verify.html b/contrib/bind9/doc/arm/man.dnssec-verify.html index be68c50ab..3d1bb3225 100644 --- a/contrib/bind9/doc/arm/man.dnssec-verify.html +++ b/contrib/bind9/doc/arm/man.dnssec-verify.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - dnssec-verify - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,17 +48,17 @@

Synopsis

dnssec-verify [-c class] [-E engine] [-I input-format] [-o origin] [-v level] [-V] [-x] [-z] {zonefile}

-
-

DESCRIPTION

-

dnssec-verify +

+

DESCRIPTION

+

dnssec-verify verifies that a zone is fully signed for each algorithm found in the DNSKEY RRset for the zone, and that the NSEC / NSEC3 chains are complete.

-
-

OPTIONS

-
+
+

OPTIONS

+
-c class

Specifies the DNS class of the zone. @@ -67,8 +66,8 @@

-I input-format

The format of the input zone file. - Possible formats are "text" (default) - and "raw". + Possible formats are "text" (default) + and "raw". This option is primarily intended to be used for dynamic signed zones so that the dumped zone file in a non-text format containing updates can be verified independently. @@ -95,7 +94,7 @@ will be signed by all active keys. When this flag is set, it will not be an error if the DNSKEY RRset is not signed by zone-signing keys. This corresponds to the -x - option in dnssec-signzone. + option in dnssec-signzone.

-z
@@ -114,7 +113,7 @@ will be signed by a non-revoked key for the same algorithm that includes the self-signed key; the same key may be used for both purposes. This corresponds to the -z - option in dnssec-signzone. + option in dnssec-signzone.

zonefile
@@ -123,19 +122,14 @@

-
-

SEE ALSO

+
+

SEE ALSO

dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 4033.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -156,6 +150,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.genrandom.html b/contrib/bind9/doc/arm/man.genrandom.html index 5a8530d18..9552a57c7 100644 --- a/contrib/bind9/doc/arm/man.genrandom.html +++ b/contrib/bind9/doc/arm/man.genrandom.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - genrandom - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,18 +48,18 @@

Synopsis

genrandom [-n number] {size} {filename}

-
-

DESCRIPTION

+
+

DESCRIPTION

- genrandom + genrandom generates a file or a set of files containing a specified quantity of pseudo-random data, which can be used as a source of entropy for other commands on systems with no random device.

-
-

ARGUMENTS

-
+
+

ARGUMENTS

+
-n number

In place of generating one file, generates number @@ -76,18 +75,13 @@

-
-

SEE ALSO

+
+

SEE ALSO

rand(3), arc4random(3)

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -108,6 +102,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.host.html b/contrib/bind9/doc/arm/man.host.html index e36dba365..393de1676 100644 --- a/contrib/bind9/doc/arm/man.host.html +++ b/contrib/bind9/doc/arm/man.host.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - host - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,34 +48,34 @@

Synopsis

host [-aCdlnrsTwv] [-c class] [-N ndots] [-R number] [-t type] [-W wait] [-m flag] [-4] [-6] [-v] [-V] {name} [server]

-
-

DESCRIPTION

-

host +

+

DESCRIPTION

+

host is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. When no arguments or options are given, - host + host prints a short summary of its command line arguments and options.

name is the domain name that is to be looked up. It can also be a dotted-decimal IPv4 address or a colon-delimited - IPv6 address, in which case host will by + IPv6 address, in which case host will by default perform a reverse lookup for that address. server is an optional argument which is either - the name or IP address of the name server that host + the name or IP address of the name server that host should query instead of the server or servers listed in /etc/resolv.conf.

The -a (all) option is equivalent to setting the - -v option and asking host to make + -v option and asking host to make a query of type ANY.

- When the -C option is used, host + When the -C option is used, host will attempt to display the SOA records for zone name from all the listed authoritative name @@ -90,7 +89,7 @@ Chaosnet class resource records. The default class is IN (Internet).

- Verbose output is generated by host when + Verbose output is generated by host when the -d or -v option is used. The two options are equivalent. They have been provided for backwards @@ -100,7 +99,7 @@

List mode is selected by the -l option. This makes - host perform a zone transfer for zone + host perform a zone transfer for zone name. Transfer the zone printing out the NS, PTR and address records (A/AAAA). If combined with -a @@ -128,7 +127,7 @@ The number of UDP retries for a lookup can be changed with the -R option. number indicates - how many times host will repeat a query + how many times host will repeat a query that does not get answered. The default number of retries is 1. If number is negative or zero, the @@ -138,39 +137,39 @@

Non-recursive queries can be made via the -r option. Setting this option clears the RD — recursion - desired — bit in the query which host makes. + desired — bit in the query which host makes. This should mean that the name server receiving the query will not attempt to resolve name. The - -r option enables host + -r option enables host to mimic the behavior of a name server by making non-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers.

- By default, host uses UDP when making + By default, host uses UDP when making queries. The -T option makes it use a TCP connection when querying the name server. TCP will be automatically selected for queries that require it, such as zone transfer (AXFR) requests.

- The -4 option forces host to only + The -4 option forces host to only use IPv4 query transport. The -6 option forces - host to only use IPv6 query transport. + host to only use IPv6 query transport.

The -t option is used to select the query type. type can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified, - host automatically selects an appropriate + host automatically selects an appropriate query type. By default, it looks for A, AAAA, and MX records, but if the -C option was given, queries will be made for SOA records, and if name is a dotted-decimal IPv4 - address or colon-delimited IPv6 address, host will + address or colon-delimited IPv6 address, host will query for PTR records. If a query type of IXFR is chosen the starting serial number can be specified by appending an equal followed by the starting serial number (e.g. -t IXFR=12345678). @@ -178,18 +177,18 @@

The time to wait for a reply can be controlled through the -W and -w options. The - -W option makes host + -W option makes host wait for wait seconds. If wait is less than one, the wait interval is set to one second. When the - -w option is used, host + -w option is used, host will effectively wait forever for a reply. The time to wait for a response will be set to the number of seconds given by the hardware's maximum value for an integer quantity.

- The -s option tells host + The -s option tells host not to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behavior. @@ -201,31 +200,31 @@ trace.

- The -V option causes host + The -V option causes host to print the version number and exit.

-
-

IDN SUPPORT

+
+

IDN SUPPORT

- If host has been built with IDN (internationalized - domain name) support, it can accept and display non-ASCII domain names. - host appropriately converts character encoding of + If host has been built with IDN (internationalized + domain name) support, it can accept and display non-ASCII domain names. + host appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server. If you'd like to turn off the IDN support for some reason, defines the IDN_DISABLE environment variable. The IDN support is disabled if the variable is set when - host runs. + host runs.

-
-

FILES

+
+

FILES

/etc/resolv.conf

-
-

SEE ALSO

+
+

SEE ALSO

dig(1), named(8).

@@ -249,6 +248,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.isc-hmac-fixup.html b/contrib/bind9/doc/arm/man.isc-hmac-fixup.html index 20367ea67..ca78b731e 100644 --- a/contrib/bind9/doc/arm/man.isc-hmac-fixup.html +++ b/contrib/bind9/doc/arm/man.isc-hmac-fixup.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - isc-hmac-fixup - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,8 +48,8 @@

Synopsis

isc-hmac-fixup {algorithm} {secret}

-
-

DESCRIPTION

+
+

DESCRIPTION

Versions of BIND 9 up to and including BIND 9.6 had a bug causing HMAC-SHA* TSIG keys which were longer than the digest length of the @@ -62,11 +61,11 @@

This bug has been fixed in BIND 9.7. However, the fix may cause incompatibility between older and newer versions of - BIND, when using long keys. isc-hmac-fixup + BIND, when using long keys. isc-hmac-fixup modifies those keys to restore compatibility.

- To modify a key, run isc-hmac-fixup and + To modify a key, run isc-hmac-fixup and specify the key's algorithm and secret on the command line. If the secret is longer than the digest length of the algorithm (64 bytes for SHA1 through SHA256, or 128 bytes for SHA384 and SHA512), then a @@ -75,10 +74,10 @@ printed without modification.)

-
-

SECURITY CONSIDERATIONS

+
+

SECURITY CONSIDERATIONS

- Secrets that have been converted by isc-hmac-fixup + Secrets that have been converted by isc-hmac-fixup are shortened, but as this is how the HMAC protocol works in operation anyway, it does not affect security. RFC 2104 notes, "Keys longer than [the digest length] are acceptable but the @@ -86,18 +85,13 @@ strength."

-
-

SEE ALSO

+
+

SEE ALSO

BIND 9 Administrator Reference Manual, RFC 2104.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -118,6 +112,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.lwresd.html b/contrib/bind9/doc/arm/man.lwresd.html new file mode 100644 index 000000000..f62e50157 --- /dev/null +++ b/contrib/bind9/doc/arm/man.lwresd.html @@ -0,0 +1,258 @@ + + + + +lwresd + + + + + + + +
+ + + + + + + +
lwresd
+Prev Manual pages Next +
+
+
+
+
+
+

Name

+

lwresd — lightweight resolver daemon

+
+
+

Synopsis

+

lwresd [-c config-file] [-C config-file] [-d debug-level] [-f] [-g] [-i pid-file] [-m flag] [-n #cpus] [-P port] [-p port] [-s] [-t directory] [-u user] [-v] [-4] [-6]

+
+
+

DESCRIPTION

+

lwresd + is the daemon providing name lookup + services to clients that use the BIND 9 lightweight resolver + library. It is essentially a stripped-down, caching-only name + server that answers queries using the BIND 9 lightweight + resolver protocol rather than the DNS protocol. +

+

lwresd + listens for resolver queries on a + UDP port on the IPv4 loopback interface, 127.0.0.1. This + means that lwresd can only be used by + processes running on the local machine. By default, UDP port + number 921 is used for lightweight resolver requests and + responses. +

+

+ Incoming lightweight resolver requests are decoded by the + server which then resolves them using the DNS protocol. When + the DNS lookup completes, lwresd encodes + the answers in the lightweight resolver format and returns + them to the client that made the request. +

+

+ If /etc/resolv.conf contains any + nameserver entries, lwresd + sends recursive DNS queries to those servers. This is similar + to the use of forwarders in a caching name server. If no + nameserver entries are present, or if + forwarding fails, lwresd resolves the + queries autonomously starting at the root name servers, using + a built-in list of root server hints. +

+
+
+

OPTIONS

+
+
-4
+

+ Use IPv4 only even if the host machine is capable of IPv6. + -4 and -6 are mutually + exclusive. +

+
-6
+

+ Use IPv6 only even if the host machine is capable of IPv4. + -4 and -6 are mutually + exclusive. +

+
-c config-file
+

+ Use config-file as the + configuration file instead of the default, + /etc/lwresd.conf. + + -c can not be used with -C. +

+
-C config-file
+

+ Use config-file as the + configuration file instead of the default, + /etc/resolv.conf. + -C can not be used with -c. +

+
-d debug-level
+

+ Set the daemon's debug level to debug-level. + Debugging traces from lwresd become + more verbose as the debug level increases. +

+
-f
+

+ Run the server in the foreground (i.e. do not daemonize). +

+
-g
+

+ Run the server in the foreground and force all logging + to stderr. +

+
-i pid-file
+

+ Use pid-file as the + PID file instead of the default, + /var/run/lwresd/lwresd.pid. +

+
-m flag
+

+ Turn on memory usage debugging flags. Possible flags are + usage, + trace, + record, + size, and + mctx. + These correspond to the ISC_MEM_DEBUGXXXX flags described in + <isc/mem.h>. +

+
-n #cpus
+

+ Create #cpus worker threads + to take advantage of multiple CPUs. If not specified, + lwresd will try to determine the + number of CPUs present and create one thread per CPU. + If it is unable to determine the number of CPUs, a + single worker thread will be created. +

+
-P port
+

+ Listen for lightweight resolver queries on port + port. If + not specified, the default is port 921. +

+
-p port
+

+ Send DNS lookups to port port. If not + specified, the default is port 53. This provides a + way of testing the lightweight resolver daemon with a + name server that listens for queries on a non-standard + port number. +

+
-s
+
+

+ Write memory usage statistics to stdout + on exit. +

+
+

Note

+

+ This option is mainly of interest to BIND 9 developers + and may be removed or changed in a future release. +

+
+
+
-t directory
+
+

Chroot + to directory after + processing the command line arguments, but before + reading the configuration file. +

+
+

Warning

+

+ This option should be used in conjunction with the + -u option, as chrooting a process + running as root doesn't enhance security on most + systems; the way chroot(2) is + defined allows a process with root privileges to + escape a chroot jail. +

+
+
+
-u user
+

Setuid + to user after completing + privileged operations, such as creating sockets that + listen on privileged ports. +

+
-v
+

+ Report the version number and exit. +

+
+
+
+

FILES

+
+
/etc/resolv.conf
+

+ The default configuration file. +

+
/var/run/lwresd.pid
+

+ The default process-id file. +

+
+
+
+

SEE ALSO

+

named(8), + lwres(3), + resolver(5). +

+
+
+
+
+ + + + + + + + + + + +
+Prev Up Next +
+named.conf Home named-journalprint +
+
+

BIND 9.9.9-P3 (Extended Support Version)

+ + diff --git a/contrib/bind9/doc/arm/man.named-checkconf.html b/contrib/bind9/doc/arm/man.named-checkconf.html index 0c888027e..37495c1fd 100644 --- a/contrib/bind9/doc/arm/man.named-checkconf.html +++ b/contrib/bind9/doc/arm/man.named-checkconf.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - named-checkconf - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,29 +48,29 @@

Synopsis

named-checkconf [-h] [-v] [-j] [-t directory] {filename} [-p] [-x] [-z]

-
-

DESCRIPTION

-

named-checkconf +

+

DESCRIPTION

+

named-checkconf checks the syntax, but not the semantics, of a - named configuration file. The file is parsed + named configuration file. The file is parsed and checked for syntax errors, along with all files included by it. If no file is specified, /etc/named.conf is read by default.

- Note: files that named reads in separate + Note: files that named reads in separate parser contexts, such as rndc.key and bind.keys, are not automatically read - by named-checkconf. Configuration - errors in these files may cause named to - fail to run, even if named-checkconf was - successful. named-checkconf can be run + by named-checkconf. Configuration + errors in these files may cause named to + fail to run, even if named-checkconf was + successful. named-checkconf can be run on these files explicitly, however.

-
-

OPTIONS

-
+
+

OPTIONS

+
-h

Print the usage summary and exit. @@ -84,7 +83,7 @@

-v

- Print the version of the named-checkconf + Print the version of the named-checkconf program and exit.

-p
@@ -118,25 +117,20 @@

-
-

RETURN VALUES

-

named-checkconf +

+

RETURN VALUES

+

named-checkconf returns an exit status of 1 if errors were detected and 0 otherwise.

-
-

SEE ALSO

+
+

SEE ALSO

named(8), named-checkzone(8), BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -157,6 +151,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.named-checkzone.html b/contrib/bind9/doc/arm/man.named-checkzone.html index beb1273e2..244371986 100644 --- a/contrib/bind9/doc/arm/man.named-checkzone.html +++ b/contrib/bind9/doc/arm/man.named-checkzone.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - named-checkzone - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -50,29 +49,29 @@

named-checkzone [-d] [-h] [-j] [-q] [-v] [-c class] [-f format] [-F format] [-i mode] [-k mode] [-m mode] [-M mode] [-n mode] [-L serial] [-o filename] [-r mode] [-s style] [-S mode] [-t directory] [-T mode] [-w directory] [-D] [-W mode] {zonename} {filename}

named-compilezone [-d] [-j] [-q] [-v] [-c class] [-C mode] [-f format] [-F format] [-i mode] [-k mode] [-m mode] [-n mode] [-L serial] [-r mode] [-s style] [-t directory] [-T mode] [-w directory] [-D] [-W mode] {-o filename} {zonename} {filename}

-
-

DESCRIPTION

-

named-checkzone +

+

DESCRIPTION

+

named-checkzone checks the syntax and integrity of a zone file. It performs the - same checks as named does when loading a - zone. This makes named-checkzone useful for + same checks as named does when loading a + zone. This makes named-checkzone useful for checking zone files before configuring them into a name server.

- named-compilezone is similar to - named-checkzone, but it always dumps the + named-compilezone is similar to + named-checkzone, but it always dumps the zone contents to a specified file in a specified format. Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file - loaded by named. + loaded by named. When manually specified otherwise, the check levels must at least be as strict as those specified in the - named configuration file. + named configuration file.

-
-

OPTIONS

-
+
+

OPTIONS

+
-d

Enable debugging. @@ -87,7 +86,7 @@

-v

- Print the version of the named-checkzone + Print the version of the named-checkzone program and exit.

-j
@@ -102,133 +101,133 @@

Perform post-load zone integrity checks. Possible modes are - "full" (default), - "full-sibling", - "local", - "local-sibling" and - "none". + "full" (default), + "full-sibling", + "local", + "local-sibling" and + "none".

- Mode "full" checks that MX records + Mode "full" checks that MX records refer to A or AAAA record (both in-zone and out-of-zone - hostnames). Mode "local" only + hostnames). Mode "local" only checks MX records which refer to in-zone hostnames.

- Mode "full" checks that SRV records + Mode "full" checks that SRV records refer to A or AAAA record (both in-zone and out-of-zone - hostnames). Mode "local" only + hostnames). Mode "local" only checks SRV records which refer to in-zone hostnames.

- Mode "full" checks that delegation NS + Mode "full" checks that delegation NS records refer to A or AAAA record (both in-zone and out-of-zone hostnames). It also checks that glue address records in the zone match those advertised by the child. - Mode "local" only checks NS records which + Mode "local" only checks NS records which refer to in-zone hostnames or that some required glue exists, that is when the nameserver is in a child zone.

- Mode "full-sibling" and - "local-sibling" disable sibling glue - checks but are otherwise the same as "full" - and "local" respectively. + Mode "full-sibling" and + "local-sibling" disable sibling glue + checks but are otherwise the same as "full" + and "local" respectively.

- Mode "none" disables the checks. + Mode "none" disables the checks.

-f format

Specify the format of the zone file. - Possible formats are "text" (default) - and "raw". + Possible formats are "text" (default) + and "raw".

-F format

Specify the format of the output file specified. - For named-checkzone, + For named-checkzone, this does not cause any effects unless it dumps the zone contents.

- Possible formats are "text" (default) - and "raw" or "raw=N", + Possible formats are "text" (default) + and "raw" or "raw=N", which store the zone in a binary format for rapid loading - by named. "raw=N" + by named. "raw=N" specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of - named; if N is 1, the file can be read + named; if N is 1, the file can be read by release 9.9.0 or higher. The default is 1.

-k mode

- Perform "check-names" checks with the + Perform "check-names" checks with the specified failure mode. - Possible modes are "fail" - (default for named-compilezone), - "warn" - (default for named-checkzone) and - "ignore". + Possible modes are "fail" + (default for named-compilezone), + "warn" + (default for named-checkzone) and + "ignore".

-L serial

- When compiling a zone to 'raw' format, set the "source serial" + When compiling a zone to 'raw' format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.)

-m mode

Specify whether MX records should be checked to see if they - are addresses. Possible modes are "fail", - "warn" (default) and - "ignore". + are addresses. Possible modes are "fail", + "warn" (default) and + "ignore".

-M mode

Check if a MX record refers to a CNAME. - Possible modes are "fail", - "warn" (default) and - "ignore". + Possible modes are "fail", + "warn" (default) and + "ignore".

-n mode

Specify whether NS records should be checked to see if they are addresses. - Possible modes are "fail" - (default for named-compilezone), - "warn" - (default for named-checkzone) and - "ignore". + Possible modes are "fail" + (default for named-compilezone), + "warn" + (default for named-checkzone) and + "ignore".

-o filename

Write zone output to filename. If filename is - then write to standard out. - This is mandatory for named-compilezone. + This is mandatory for named-compilezone.

-r mode

Check for records that are treated as different by DNSSEC but - are semantically equal in plain DNS. - Possible modes are "fail", - "warn" (default) and - "ignore". + are semantically equal in plain DNS. + Possible modes are "fail", + "warn" (default) and + "ignore".

-s style

Specify the style of the dumped zone file. - Possible styles are "full" (default) - and "relative". + Possible styles are "full" (default) + and "relative". The full format is most suitable for processing automatically by a separate script. On the other hand, the relative format is more human-readable and is thus suitable for editing by hand. - For named-checkzone + For named-checkzone this does not cause any effects unless it dumps the zone contents. It also does not have any meaning if the output format @@ -237,9 +236,9 @@

-S mode

Check if a SRV record refers to a CNAME. - Possible modes are "fail", - "warn" (default) and - "ignore". + Possible modes are "fail", + "warn" (default) and + "ignore".

-t directory

@@ -252,8 +251,8 @@

Check if Sender Policy Framework (SPF) records exist and issues a warning if an SPF-formatted TXT record is - not also present. Possible modes are "warn" - (default), "ignore". + not also present. Possible modes are "warn" + (default), "ignore".

-w directory

@@ -266,16 +265,16 @@

-D

Dump zone file in canonical format. - This is always enabled for named-compilezone. + This is always enabled for named-compilezone.

-W mode

Specify whether to check for non-terminal wildcards. Non-terminal wildcards are almost always the result of a failure to understand the wildcard matching algorithm (RFC 1034). - Possible modes are "warn" (default) + Possible modes are "warn" (default) and - "ignore". + "ignore".

zonename

@@ -287,26 +286,21 @@

-
-

RETURN VALUES

-

named-checkzone +

+

RETURN VALUES

+

named-checkzone returns an exit status of 1 if errors were detected and 0 otherwise.

-
-

SEE ALSO

+
+

SEE ALSO

named(8), named-checkconf(8), RFC 1035, BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -327,6 +321,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.named-journalprint.html b/contrib/bind9/doc/arm/man.named-journalprint.html index 237f6c750..74ccac0a9 100644 --- a/contrib/bind9/doc/arm/man.named-journalprint.html +++ b/contrib/bind9/doc/arm/man.named-journalprint.html @@ -14,15 +14,14 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - named-journalprint - - + + - + @@ -31,7 +30,7 @@ named-journalprint -Prev  +Prev  Manual pages  Next @@ -39,7 +38,7 @@
-
+

Name

@@ -49,17 +48,17 @@

Synopsis

named-journalprint {journal}

-
-

DESCRIPTION

+
+

DESCRIPTION

- named-journalprint + named-journalprint prints the contents of a zone journal file in a human-readable - form. + form.

- Journal files are automatically created by named + Journal files are automatically created by named when changes are made to dynamic zones (e.g., by - nsupdate). They record each addition + nsupdate). They record each addition or deletion of a resource record, in binary format, allowing the changes to be re-applied to the zone when the server is restarted after a shutdown or crash. By default, the name of @@ -68,46 +67,41 @@ zone file.

- named-journalprint converts the contents of a given + named-journalprint converts the contents of a given journal file into a human-readable text format. Each line begins with "add" or "del", to indicate whether the record was added or deleted, and continues with the resource record in master-file format.

-
-

SEE ALSO

+
+

SEE ALSO

named(8), nsupdate(8), BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
+Prev  +lwresd 
-Prev  Up  Next
-named  Home  nsupdate
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.named.conf.html b/contrib/bind9/doc/arm/man.named.conf.html new file mode 100644 index 000000000..8242a0e28 --- /dev/null +++ b/contrib/bind9/doc/arm/man.named.conf.html @@ -0,0 +1,677 @@ + + + + +named.conf + + + + + + + +
+ + + + + + + +
named.conf
+Prev Manual pages Next +
+
+
+
+
+
+

Name

+

named.conf — configuration file for named

+
+
+

Synopsis

+

named.conf

+
+
+

DESCRIPTION

+

named.conf is the configuration file + for + named. Statements are enclosed + in braces and terminated with a semi-colon. Clauses in + the statements are also semi-colon terminated. The usual + comment styles are supported: +

+

+ C style: /* */ +

+

+ C++ style: // to end of line +

+

+ Unix style: # to end of line +

+
+
+

ACL

+


+acl string { address_match_element; ... };
+
+

+
+
+

KEY

+


+key domain_name {
+ algorithm string;
+ secret string;
+};
+

+
+
+

MASTERS

+


+masters string [ port integer ] {
+ ( masters | ipv4_address [port integer] |
+ ipv6_address [port integer] ) [ key string ]; ...
+};
+

+
+
+

SERVER

+


+server ( ipv4_address[/prefixlen] | ipv6_address[/prefixlen] ) {
+ bogus boolean;
+ edns boolean;
+ edns-udp-size integer;
+ max-udp-size integer;
+ provide-ixfr boolean;
+ request-ixfr boolean;
+ keys server_key;
+ transfers integer;
+ transfer-format ( many-answers | one-answer );
+ transfer-source ( ipv4_address | * )
+ [ port ( integer | * ) ];
+ transfer-source-v6 ( ipv6_address | * )
+ [ port ( integer | * ) ];
+
+ support-ixfr boolean; // obsolete
+};
+

+
+
+

TRUSTED-KEYS

+


+trusted-keys {
+ domain_name flags protocol algorithm key; ...
+};
+

+
+
+

MANAGED-KEYS

+


+managed-keys {
+ domain_name initial-key flags protocol algorithm key; ...
+};
+

+
+
+

CONTROLS

+


+controls {
+ inet ( ipv4_address | ipv6_address | * )
+ [ port ( integer | * ) ]
+ allow { address_match_element; ... }
+ [ keys { string; ... } ];
+ unix unsupported; // not implemented
+};
+

+
+
+

LOGGING

+


+logging {
+ channel string {
+ file log_file;
+ syslog optional_facility;
+ null;
+ stderr;
+ severity log_severity;
+ print-time boolean;
+ print-severity boolean;
+ print-category boolean;
+ };
+ category string { string; ... };
+};
+

+
+
+

LWRES

+


+lwres {
+ listen-on [ port integer ] {
+ ( ipv4_address | ipv6_address ) [ port integer ]; ...
+ };
+ view string optional_class;
+ search { string; ... };
+ ndots integer;
+};
+

+
+
+

OPTIONS

+


+options {
+ avoid-v4-udp-ports { port; ... };
+ avoid-v6-udp-ports { port; ... };
+ blackhole { address_match_element; ... };
+ coresize size;
+ datasize size;
+ directory quoted_string;
+ dump-file quoted_string;
+ files size;
+ heartbeat-interval integer;
+ host-statistics boolean; // not implemented
+ host-statistics-max number; // not implemented
+ hostname ( quoted_string | none );
+ interface-interval integer;
+ listen-on [ port integer ] { address_match_element; ... };
+ listen-on-v6 [ port integer ] { address_match_element; ... };
+ match-mapped-addresses boolean;
+ memstatistics-file quoted_string;
+ pid-file ( quoted_string | none );
+ port integer;
+ querylog boolean;
+ recursing-file quoted_string;
+ reserved-sockets integer;
+ random-device quoted_string;
+ recursive-clients integer;
+ serial-query-rate integer;
+ server-id ( quoted_string | hostname | none );
+ stacksize size;
+ statistics-file quoted_string;
+ statistics-interval integer; // not yet implemented
+ tcp-clients integer;
+ tcp-listen-queue integer;
+ tkey-dhkey quoted_string integer;
+ tkey-gssapi-credential quoted_string;
+ tkey-gssapi-keytab quoted_string;
+ tkey-domain quoted_string;
+ transfers-per-ns integer;
+ transfers-in integer;
+ transfers-out integer;
+ version ( quoted_string | none );
+ allow-recursion { address_match_element; ... };
+ allow-recursion-on { address_match_element; ... };
+ sortlist { address_match_element; ... };
+ topology { address_match_element; ... }; // not implemented
+ auth-nxdomain boolean; // default changed
+ minimal-responses boolean;
+ recursion boolean;
+ rrset-order {
+ [ class string ] [ type string ]
+ [ name quoted_string ] string string; ...
+ };
+ provide-ixfr boolean;
+ request-ixfr boolean;
+ rfc2308-type1 boolean; // not yet implemented
+ additional-from-auth boolean;
+ additional-from-cache boolean;
+ query-source ( ( ipv4_address | * ) | [ address ( ipv4_address | * ) ] ) [ port ( integer | * ) ];
+ query-source-v6 ( ( ipv6_address | * ) | [ address ( ipv6_address | * ) ] ) [ port ( integer | * ) ];
+ use-queryport-pool boolean;
+ queryport-pool-ports integer;
+ queryport-pool-updateinterval integer;
+ cleaning-interval integer;
+ resolver-query-timeout integer;
+ min-roots integer; // not implemented
+ lame-ttl integer;
+ max-ncache-ttl integer;
+ max-cache-ttl integer;
+ transfer-format ( many-answers | one-answer );
+ max-cache-size size;
+ max-acache-size size;
+ clients-per-query number;
+ max-clients-per-query number;
+ check-names ( master | slave | response )
+ ( fail | warn | ignore );
+ check-mx ( fail | warn | ignore );
+ check-integrity boolean;
+ check-mx-cname ( fail | warn | ignore );
+ check-srv-cname ( fail | warn | ignore );
+ cache-file quoted_string; // test option
+ suppress-initial-notify boolean; // not yet implemented
+ preferred-glue string;
+ dual-stack-servers [ port integer ] {
+ ( quoted_string [port integer] |
+ ipv4_address [port integer] |
+ ipv6_address [port integer] ); ...
+ };
+ edns-udp-size integer;
+ max-udp-size integer;
+ root-delegation-only [ exclude { quoted_string; ... } ];
+ disable-algorithms string { string; ... };
+ dnssec-enable boolean;
+ dnssec-validation boolean;
+ dnssec-lookaside ( auto | no | domain trust-anchor domain );
+ dnssec-must-be-secure string boolean;
+ dnssec-accept-expired boolean;
+
+ dns64-server string;
+ dns64-contact string;
+ dns64 prefix {
+ clients { <replacable>acl</replacable>; };
+ exclude { <replacable>acl</replacable>; };
+ mapped { <replacable>acl</replacable>; };
+ break-dnssec boolean;
+ recursive-only boolean;
+ suffix ipv6_address;
+ };
+
+ empty-server string;
+ empty-contact string;
+ empty-zones-enable boolean;
+ disable-empty-zone string;
+
+ dialup dialuptype;
+ ixfr-from-differences ixfrdiff;
+
+ allow-query { address_match_element; ... };
+ allow-query-on { address_match_element; ... };
+ allow-query-cache { address_match_element; ... };
+ allow-query-cache-on { address_match_element; ... };
+ allow-transfer { address_match_element; ... };
+ allow-update { address_match_element; ... };
+ allow-update-forwarding { address_match_element; ... };
+ update-check-ksk boolean;
+ dnssec-dnskey-kskonly boolean;
+
+ masterfile-format ( text | raw );
+ notify notifytype;
+ notify-source ( ipv4_address | * ) [ port ( integer | * ) ];
+ notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ];
+ notify-delay seconds;
+ notify-to-soa boolean;
+ also-notify [ port integer ] { ( ipv4_address | ipv6_address )
+ [ port integer ]; ...
+ [ key keyname ] ... };
+ allow-notify { address_match_element; ... };
+
+ forward ( first | only );
+ forwarders [ port integer ] {
+ ( ipv4_address | ipv6_address ) [ port integer ]; ...
+ };
+
+ max-journal-size size_no_default;
+ max-transfer-time-in integer;
+ max-transfer-time-out integer;
+ max-transfer-idle-in integer;
+ max-transfer-idle-out integer;
+ max-retry-time integer;
+ min-retry-time integer;
+ max-refresh-time integer;
+ min-refresh-time integer;
+ multi-master boolean;
+
+ sig-validity-interval integer;
+ sig-re-signing-interval integer;
+ sig-signing-nodes integer;
+ sig-signing-signatures integer;
+ sig-signing-type integer;
+
+ transfer-source ( ipv4_address | * )
+ [ port ( integer | * ) ];
+ transfer-source-v6 ( ipv6_address | * )
+ [ port ( integer | * ) ];
+
+ alt-transfer-source ( ipv4_address | * )
+ [ port ( integer | * ) ];
+ alt-transfer-source-v6 ( ipv6_address | * )
+ [ port ( integer | * ) ];
+ use-alt-transfer-source boolean;
+
+ zone-statistics boolean;
+ key-directory quoted_string;
+ managed-keys-directory quoted_string;
+ auto-dnssec allow|maintain|off;
+ try-tcp-refresh boolean;
+ zero-no-soa-ttl boolean;
+ zero-no-soa-ttl-cache boolean;
+ dnssec-secure-to-insecure boolean;
+ deny-answer-addresses {
+ address_match_list
+ } [ except-from { namelist } ];
+ deny-answer-aliases {
+ namelist
+ } [ except-from { namelist } ];
+
+ nsec3-test-zone boolean;  // testing only
+
+ allow-v6-synthesis { address_match_element; ... }; // obsolete
+ deallocate-on-exit boolean; // obsolete
+ fake-iquery boolean; // obsolete
+ fetch-glue boolean; // obsolete
+ has-old-clients boolean; // obsolete
+ maintain-ixfr-base boolean; // obsolete
+ max-ixfr-log-size size; // obsolete
+ multiple-cnames boolean; // obsolete
+ named-xfer quoted_string; // obsolete
+ serial-queries integer; // obsolete
+ treat-cr-as-space boolean; // obsolete
+ use-id-pool boolean; // obsolete
+ use-ixfr boolean; // obsolete
+};
+

+
+
+

VIEW

+


+view string optional_class {
+ match-clients { address_match_element; ... };
+ match-destinations { address_match_element; ... };
+ match-recursive-only boolean;
+
+ key string {
+ algorithm string;
+ secret string;
+ };
+
+ zone string optional_class {
+ ...
+ };
+
+ server ( ipv4_address[/prefixlen] | ipv6_address[/prefixlen] ) {
+ ...
+ };
+
+ trusted-keys {
+ string integer integer integer quoted_string;
+ [...]
+ };
+
+ allow-recursion { address_match_element; ... };
+ allow-recursion-on { address_match_element; ... };
+ sortlist { address_match_element; ... };
+ topology { address_match_element; ... }; // not implemented
+ auth-nxdomain boolean; // default changed
+ minimal-responses boolean;
+ recursion boolean;
+ rrset-order {
+ [ class string ] [ type string ]
+ [ name quoted_string ] string string; ...
+ };
+ provide-ixfr boolean;
+ request-ixfr boolean;
+ rfc2308-type1 boolean; // not yet implemented
+ additional-from-auth boolean;
+ additional-from-cache boolean;
+ query-source ( ( ipv4_address | * ) | [ address ( ipv4_address | * ) ] ) [ port ( integer | * ) ];
+ query-source-v6 ( ( ipv6_address | * ) | [ address ( ipv6_address | * ) ] ) [ port ( integer | * ) ];
+ use-queryport-pool boolean;
+ queryport-pool-ports integer;
+ queryport-pool-updateinterval integer;
+ cleaning-interval integer;
+ resolver-query-timeout integer;
+ min-roots integer; // not implemented
+ lame-ttl integer;
+ max-ncache-ttl integer;
+ max-cache-ttl integer;
+ transfer-format ( many-answers | one-answer );
+ max-cache-size size;
+ max-acache-size size;
+ clients-per-query number;
+ max-clients-per-query number;
+ check-names ( master | slave | response )
+ ( fail | warn | ignore );
+ check-mx ( fail | warn | ignore );
+ check-integrity boolean;
+ check-mx-cname ( fail | warn | ignore );
+ check-srv-cname ( fail | warn | ignore );
+ cache-file quoted_string; // test option
+ suppress-initial-notify boolean; // not yet implemented
+ preferred-glue string;
+ dual-stack-servers [ port integer ] {
+ ( quoted_string [port integer] |
+ ipv4_address [port integer] |
+ ipv6_address [port integer] ); ...
+ };
+ edns-udp-size integer;
+ max-udp-size integer;
+ root-delegation-only [ exclude { quoted_string; ... } ];
+ disable-algorithms string { string; ... };
+ dnssec-enable boolean;
+ dnssec-validation boolean;
+ dnssec-lookaside ( auto | no | domain trust-anchor domain );
+ dnssec-must-be-secure string boolean;
+ dnssec-accept-expired boolean;
+
+ dns64-server string;
+ dns64-contact string;
+ dns64 prefix {
+ clients { <replacable>acl</replacable>; };
+ exclude { <replacable>acl</replacable>; };
+ mapped { <replacable>acl</replacable>; };
+ break-dnssec boolean;
+ recursive-only boolean;
+ suffix ipv6_address;
+ };
+
+ empty-server string;
+ empty-contact string;
+ empty-zones-enable boolean;
+ disable-empty-zone string;
+
+ dialup dialuptype;
+ ixfr-from-differences ixfrdiff;
+
+ allow-query { address_match_element; ... };
+ allow-query-on { address_match_element; ... };
+ allow-query-cache { address_match_element; ... };
+ allow-query-cache-on { address_match_element; ... };
+ allow-transfer { address_match_element; ... };
+ allow-update { address_match_element; ... };
+ allow-update-forwarding { address_match_element; ... };
+ update-check-ksk boolean;
+ dnssec-dnskey-kskonly boolean;
+
+ masterfile-format ( text | raw );
+ notify notifytype;
+ notify-source ( ipv4_address | * ) [ port ( integer | * ) ];
+ notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ];
+ notify-delay seconds;
+ notify-to-soa boolean;
+ also-notify [ port integer ] { ( ipv4_address | ipv6_address )
+ [ port integer ]; ...
+ [ key keyname ] ... };
+ allow-notify { address_match_element; ... };
+
+ forward ( first | only );
+ forwarders [ port integer ] {
+ ( ipv4_address | ipv6_address ) [ port integer ]; ...
+ };
+
+ max-journal-size size_no_default;
+ max-transfer-time-in integer;
+ max-transfer-time-out integer;
+ max-transfer-idle-in integer;
+ max-transfer-idle-out integer;
+ max-retry-time integer;
+ min-retry-time integer;
+ max-refresh-time integer;
+ min-refresh-time integer;
+ multi-master boolean;
+ sig-validity-interval integer;
+
+ transfer-source ( ipv4_address | * )
+ [ port ( integer | * ) ];
+ transfer-source-v6 ( ipv6_address | * )
+ [ port ( integer | * ) ];
+
+ alt-transfer-source ( ipv4_address | * )
+ [ port ( integer | * ) ];
+ alt-transfer-source-v6 ( ipv6_address | * )
+ [ port ( integer | * ) ];
+ use-alt-transfer-source boolean;
+
+ zone-statistics boolean;
+ try-tcp-refresh boolean;
+ key-directory quoted_string;
+ zero-no-soa-ttl boolean;
+ zero-no-soa-ttl-cache boolean;
+ dnssec-secure-to-insecure boolean;
+
+ allow-v6-synthesis { address_match_element; ... }; // obsolete
+ fetch-glue boolean; // obsolete
+ maintain-ixfr-base boolean; // obsolete
+ max-ixfr-log-size size; // obsolete
+};
+

+
+
+

ZONE

+


+zone string optional_class {
+ type ( master | slave | stub | hint | redirect |
+ forward | delegation-only );
+ file quoted_string;
+
+ masters [ port integer ] {
+ ( masters |
+ ipv4_address [port integer] |
+ ipv6_address [ port integer ] ) [ key string ]; ...
+ };
+
+ database string;
+ delegation-only boolean;
+ check-names ( fail | warn | ignore );
+ check-mx ( fail | warn | ignore );
+ check-integrity boolean;
+ check-mx-cname ( fail | warn | ignore );
+ check-srv-cname ( fail | warn | ignore );
+ dialup dialuptype;
+ ixfr-from-differences boolean;
+ journal quoted_string;
+ zero-no-soa-ttl boolean;
+ dnssec-secure-to-insecure boolean;
+
+ allow-query { address_match_element; ... };
+ allow-query-on { address_match_element; ... };
+ allow-transfer { address_match_element; ... };
+ allow-update { address_match_element; ... };
+ allow-update-forwarding { address_match_element; ... };
+ update-policy local |  {
+ ( grant | deny ) string
+ ( name | subdomain | wildcard | self | selfsub | selfwild |
+                  krb5-self | ms-self | krb5-subdomain | ms-subdomain |
+   tcp-self | zonesub | 6to4-self ) string
+ rrtypelist;
+ [...]
+ };
+ update-check-ksk boolean;
+ dnssec-dnskey-kskonly boolean;
+
+ masterfile-format ( text | raw );
+ notify notifytype;
+ notify-source ( ipv4_address | * ) [ port ( integer | * ) ];
+ notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ];
+ notify-delay seconds;
+ notify-to-soa boolean;
+ also-notify [ port integer ] { ( ipv4_address | ipv6_address )
+ [ port integer ]; ...
+ [ key keyname ] ... };
+ allow-notify { address_match_element; ... };
+
+ forward ( first | only );
+ forwarders [ port integer ] {
+ ( ipv4_address | ipv6_address ) [ port integer ]; ...
+ };
+
+ max-journal-size size_no_default;
+ max-transfer-time-in integer;
+ max-transfer-time-out integer;
+ max-transfer-idle-in integer;
+ max-transfer-idle-out integer;
+ max-retry-time integer;
+ min-retry-time integer;
+ max-refresh-time integer;
+ min-refresh-time integer;
+ multi-master boolean;
+ request-ixfr boolean;
+ sig-validity-interval integer;
+
+ transfer-source ( ipv4_address | * )
+ [ port ( integer | * ) ];
+ transfer-source-v6 ( ipv6_address | * )
+ [ port ( integer | * ) ];
+
+ alt-transfer-source ( ipv4_address | * )
+ [ port ( integer | * ) ];
+ alt-transfer-source-v6 ( ipv6_address | * )
+ [ port ( integer | * ) ];
+ use-alt-transfer-source boolean;
+
+ zone-statistics boolean;
+ try-tcp-refresh boolean;
+ key-directory quoted_string;
+
+ nsec3-test-zone boolean;  // testing only
+
+ ixfr-base quoted_string; // obsolete
+ ixfr-tmp-file quoted_string; // obsolete
+ maintain-ixfr-base boolean; // obsolete
+ max-ixfr-log-size size; // obsolete
+ pubkey integer integer integer quoted_string; // obsolete
+};
+

+
+
+

FILES

+

/etc/named.conf +

+
+
+

SEE ALSO

+

named(8), + named-checkconf(8), + rndc(8), + BIND 9 Administrator Reference Manual. +

+
+
+
+
+ + + + + + + + + + + +
+Prev Up Next +
+named Home lwresd +
+
+

BIND 9.9.9-P3 (Extended Support Version)

+ + diff --git a/contrib/bind9/doc/arm/man.named.html b/contrib/bind9/doc/arm/man.named.html index 7090ece74..ddcf66271 100644 --- a/contrib/bind9/doc/arm/man.named.html +++ b/contrib/bind9/doc/arm/man.named.html @@ -14,16 +14,15 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - named - - + + - +
@@ -33,13 +32,13 @@ Prev  Manual pages - Next + Next
-
+

Name

@@ -49,24 +48,24 @@

Synopsis

named [-4] [-6] [-c config-file] [-d debug-level] [-E engine-name] [-f] [-g] [-M option] [-m flag] [-n #cpus] [-p port] [-s] [-S #max-socks] [-t directory] [-U #listeners] [-u user] [-v] [-V] [-x cache-file]

-
-

DESCRIPTION

-

named +

+

DESCRIPTION

+

named is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more information on the DNS, see RFCs 1033, 1034, and 1035.

- When invoked without arguments, named + When invoked without arguments, named will read the default configuration file /etc/named.conf, read any initial data, and listen for queries.

-
-

OPTIONS

-
+
+

OPTIONS

+
-4

Use IPv4 only even if the host machine is capable of IPv6. @@ -94,7 +93,7 @@

-d debug-level

Set the daemon's debug level to debug-level. - Debugging traces from named become + Debugging traces from named become more verbose as the debug level increases.

-E engine-name
@@ -137,7 +136,7 @@

Create #cpus worker threads to take advantage of multiple CPUs. If not specified, - named will try to determine the + named will try to determine the number of CPUs present and create one thread per CPU. If it is unable to determine the number of CPUs, a single worker thread will be created. @@ -163,7 +162,7 @@

-S #max-socks

- Allow named to use up to + Allow named to use up to #max-socks sockets.

@@ -180,7 +179,7 @@ specified number of sockets. Note also that the actual maximum number is normally a little fewer than the specified value because - named reserves some file descriptors + named reserves some file descriptors for its internal use.

@@ -208,13 +207,16 @@

Use #listeners worker threads to listen for incoming UDP packets on each - address. If not specified, named will + address. If not specified, named will calculate a default value based on the number of detected - CPUs: 1 for 1 CPU, 2 for 2-4 CPUs, and the number of - detected CPUs divided by 2 for values higher than 4. + CPUs: 1 for 1 CPU, and the number of detected CPUs + minus one for machines with more than 1 CPU. This cannot + be increased to a value higher than the number of CPUs. If -n has been set to a higher value than the number of detected CPUs, then -U may be increased as high as that value, but no higher. + On Windows, the number of UDP listeners is hardwired to 1 + and this option has no effect.

-u user
@@ -226,13 +228,13 @@

Note

- On Linux, named uses the kernel's + On Linux, named uses the kernel's capability mechanism to drop all root privileges except the ability to bind(2) to a privileged port and set process resource limits. Unfortunately, this means that the -u - option only works when named is + option only works when named is run on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or later, since previous kernels did not allow privileges @@ -265,14 +267,14 @@

-
-

SIGNALS

+
+

SIGNALS

In routine operation, signals should not be used to control - the nameserver; rndc should be used + the nameserver; rndc should be used instead.

-
+
SIGHUP

Force a reload of the server. @@ -286,26 +288,26 @@ The result of sending any other signals to the server is undefined.

-
-

CONFIGURATION

+
+

CONFIGURATION

- The named configuration file is too complex + The named configuration file is too complex to describe in detail here. A complete description is provided in the BIND 9 Administrator Reference Manual.

- named inherits the umask + named inherits the umask (file creation mode mask) from the parent process. If files - created by named, such as journal files, + created by named, such as journal files, need to have custom permissions, the umask should be set explicitly in the script used to start the - named process. + named process.

-
-

FILES

-
+
+

FILES

+
/etc/named.conf

The default configuration file. @@ -316,8 +318,8 @@

-
-

SEE ALSO

+
+

SEE ALSO

RFC 1033, RFC 1034, RFC 1035, @@ -329,11 +331,6 @@ BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -342,18 +339,18 @@ Prev  Up - Next + Next named-checkzone  Home - named-journalprint + named.conf
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.nsec3hash.html b/contrib/bind9/doc/arm/man.nsec3hash.html index 83c712ba0..ef3b6cdd8 100644 --- a/contrib/bind9/doc/arm/man.nsec3hash.html +++ b/contrib/bind9/doc/arm/man.nsec3hash.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - nsec3hash - - + + @@ -37,7 +36,7 @@
-
+

Name

@@ -47,17 +46,17 @@

Synopsis

nsec3hash {salt} {algorithm} {iterations} {domain}

-
-

DESCRIPTION

+
+

DESCRIPTION

- nsec3hash generates an NSEC3 hash based on + nsec3hash generates an NSEC3 hash based on a set of NSEC3 parameters. This can be used to check the validity of NSEC3 records in a signed zone.

-
-

ARGUMENTS

-
+
+

ARGUMENTS

+
salt

The salt provided to the hash algorithm. @@ -79,18 +78,13 @@

-
-

SEE ALSO

+
+

SEE ALSO

BIND 9 Administrator Reference Manual, RFC 5155.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -109,6 +103,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.nsupdate.html b/contrib/bind9/doc/arm/man.nsupdate.html index 4462acb91..45b5b3170 100644 --- a/contrib/bind9/doc/arm/man.nsupdate.html +++ b/contrib/bind9/doc/arm/man.nsupdate.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - nsupdate - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,9 +48,9 @@

Synopsis

nsupdate [-d] [-D] [-L level] [[-g] | [-o] | [-l] | [-y [hmac:]keyname:secret] | [-k keyfile]] [-t timeout] [-u udptimeout] [-r udpretries] [-R randomdev] [-v] [-V] [filename]

-
-

DESCRIPTION

-

nsupdate +

+

DESCRIPTION

+

nsupdate is used to submit Dynamic DNS Update requests as defined in RFC 2136 to a name server. This allows resource records to be added or removed from a zone @@ -62,14 +61,14 @@

Zones that are under dynamic control via - nsupdate + nsupdate or a DHCP server should not be edited by hand. Manual edits could conflict with dynamic updates and cause data to be lost.

The resource records that are dynamically added or removed with - nsupdate + nsupdate have to be in the same zone. Requests are sent to the zone's master server. This is identified by the MNAME field of the zone's SOA record. @@ -83,15 +82,15 @@

TSIG relies on a shared secret that should only be known to - nsupdate and the name server. + nsupdate and the name server. For instance, suitable key and server statements would be added to /etc/named.conf so that the name server can associate the appropriate secret key and algorithm with the IP address of the client application that will be using - TSIG authentication. You can use ddns-confgen + TSIG authentication. You can use ddns-confgen to generate suitable configuration fragments. - nsupdate + nsupdate uses the -y or -k options to provide the TSIG shared secret. These options are mutually exclusive.

@@ -107,9 +106,9 @@ 2000 can be switched on with the -o flag.

-
-

OPTIONS

-
+
+

OPTIONS

+
-d

Debug mode. This provides tracing information about the @@ -124,12 +123,12 @@

The file containing the TSIG authentication key. Keyfiles may be in two formats: a single file containing - a named.conf-format key + a named.conf-format key statement, which may be generated automatically by - ddns-confgen, or a pair of files whose names are + ddns-confgen, or a pair of files whose names are of the format K{name}.+157.+{random}.key and K{name}.+157.+{random}.private, which can be - generated by dnssec-keygen. + generated by dnssec-keygen. The -k may also be used to specify a SIG(0) key used to authenticate Dynamic DNS update requests. In this case, the key specified is not an HMAC-MD5 key. @@ -137,12 +136,12 @@

-l

Local-host only mode. This sets the server address to - localhost (disabling the server so that the server + localhost (disabling the server so that the server address cannot be overridden). Connections to the local server will use a TSIG key found in /var/run/named/session.key, - which is automatically generated by named if any - local master zone has set update-policy to - local. The location of this key file can be + which is automatically generated by named if any + local master zone has set update-policy to + local. The location of this key file can be overridden with the -k option.

-L level
@@ -185,7 +184,7 @@
-v

Use TCP even for small update requests. - By default, nsupdate + By default, nsupdate uses UDP to send update requests to the name server unless they are too large to fit in a UDP request in which case TCP will be used. TCP may be preferable when a batch of update requests is made. @@ -217,9 +216,9 @@

-
-

INPUT FORMAT

-

nsupdate +

+

INPUT FORMAT

+

nsupdate reads input from filename or standard input. @@ -238,7 +237,7 @@ and zero or more updates. This allows a suitably authenticated update request to proceed if some specified resource records are present or missing from the zone. - A blank input line (or the send command) + A blank input line (or the send command) causes the accumulated commands to be sent as one Dynamic DNS update request to the name server. @@ -246,9 +245,9 @@

The command formats and their meaning are as follows:

-
+
- server + server {servername} [port]
@@ -256,7 +255,7 @@ Sends all dynamic update requests to the name server servername. When no server statement is provided, - nsupdate + nsupdate will send updates to the master server of the correct zone. The MNAME field of that zone's SOA record will identify the master @@ -270,7 +269,7 @@ used.

- local + local {address} [port]
@@ -279,7 +278,7 @@ address. When no local statement is provided, - nsupdate + nsupdate will send updates using an address and port chosen by the system. port @@ -288,7 +287,7 @@ If no port number is specified, the system will assign one.

- zone + zone {zonename}

@@ -297,12 +296,12 @@ If no zone statement is provided, - nsupdate + nsupdate will attempt determine the correct zone to update based on the rest of the input.

- class + class {classname}

@@ -312,7 +311,7 @@ IN.

- ttl + ttl {seconds}

@@ -321,7 +320,7 @@ ttl.

- key + key [hmac:] {keyname} {secret}
@@ -330,19 +329,19 @@ keyname secret pair. If hmac is specified, then it sets the signing algorithm in use; the default is - hmac-md5. The key + hmac-md5. The key command overrides any key specified on the command line via -y or -k.

- gsstsig + gsstsig

Use GSS-TSIG to sign the updated. This is equivalent to specifying -g on the commandline.

- oldgsstsig + oldgsstsig

Use the Windows 2000 version of GSS-TSIG to sign the updated. @@ -350,7 +349,7 @@ commandline.

- realm + realm {[realm_name]}

@@ -359,7 +358,7 @@ realm is specified the saved realm is cleared.

- [prereq] nxdomain + [prereq] nxdomain {domain-name}

@@ -367,7 +366,7 @@ domain-name.

- [prereq] yxdomain + [prereq] yxdomain {domain-name}

@@ -376,7 +375,7 @@ exists (has as at least one resource record, of any type).

- [prereq] nxrrset + [prereq] nxrrset {domain-name} [class] {type} @@ -392,7 +391,7 @@ is omitted, IN (internet) is assumed.

- [prereq] yxrrset + [prereq] yxrrset {domain-name} [class] {type} @@ -409,7 +408,7 @@ is omitted, IN (internet) is assumed.

- [prereq] yxrrset + [prereq] yxrrset {domain-name} [class] {type} @@ -438,7 +437,7 @@ RDATA.

- [update] del[ete] + [update] del[ete] {domain-name} [ttl] [class] @@ -459,7 +458,7 @@ is ignored, and is only allowed for compatibility.

- [update] add + [update] add {domain-name} {ttl} [class] @@ -474,7 +473,7 @@ data.

- show + show

Displays the current message, containing all of the @@ -482,32 +481,32 @@ updates specified since the last send.

- send + send

Sends the current message. This is equivalent to entering a blank line.

- answer + answer

Displays the answer.

- debug + debug

Turn on debugging.

- version + version

Print version number.

- help + help

Print a list of commands. @@ -519,11 +518,11 @@ Lines beginning with a semicolon are comments and are ignored.

-
-

EXAMPLES

+
+

EXAMPLES

The examples below show how - nsupdate + nsupdate could be used to insert and delete resource records from the example.com zone. @@ -573,9 +572,9 @@ RRSIG, DNSKEY and NSEC records.)

-
-

FILES

-
+
+

FILES

+
/etc/resolv.conf

used to identify default name server @@ -596,8 +595,8 @@

-
-

SEE ALSO

+
+

SEE ALSO

RFC 2136, RFC 3007, @@ -611,8 +610,8 @@ dnssec-keygen(8).

-
-

BUGS

+
+

BUGS

The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library @@ -640,6 +639,6 @@

-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.rndc-confgen.html b/contrib/bind9/doc/arm/man.rndc-confgen.html index db1cfa8a5..697e44cda 100644 --- a/contrib/bind9/doc/arm/man.rndc-confgen.html +++ b/contrib/bind9/doc/arm/man.rndc-confgen.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - rndc-confgen - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,57 +48,57 @@

Synopsis

rndc-confgen [-a] [-b keysize] [-c keyfile] [-h] [-k keyname] [-p port] [-r randomfile] [-s address] [-t chrootdir] [-u user]

-
-

DESCRIPTION

-

rndc-confgen +

+

DESCRIPTION

+

rndc-confgen generates configuration files - for rndc. It can be used as a + for rndc. It can be used as a convenient alternative to writing the rndc.conf file - and the corresponding controls - and key + and the corresponding controls + and key statements in named.conf by hand. - Alternatively, it can be run with the -a + Alternatively, it can be run with the -a option to set up a rndc.key file and avoid the need for a rndc.conf file - and a controls statement altogether. + and a controls statement altogether.

-
-

OPTIONS

-
+
+

OPTIONS

+
-a

- Do automatic rndc configuration. + Do automatic rndc configuration. This creates a file rndc.key in /etc (or whatever sysconfdir was specified as when BIND was built) - that is read by both rndc - and named on startup. The + that is read by both rndc + and named on startup. The rndc.key file defines a default command channel and authentication key allowing - rndc to communicate with - named on the local host + rndc to communicate with + named on the local host with no further configuration.

- Running rndc-confgen -a allows - BIND 9 and rndc to be used as + Running rndc-confgen -a allows + BIND 9 and rndc to be used as drop-in - replacements for BIND 8 and ndc, + replacements for BIND 8 and ndc, with no changes to the existing BIND 8 named.conf file.

If a more elaborate configuration than that - generated by rndc-confgen -a + generated by rndc-confgen -a is required, for example if rndc is to be used remotely, - you should run rndc-confgen without + you should run rndc-confgen without the - -a option and set up a + -a option and set up a rndc.conf and named.conf as directed. @@ -112,13 +111,13 @@

-c keyfile

- Used with the -a option to specify + Used with the -a option to specify an alternate location for rndc.key.

-h

Prints a short summary of the options and arguments to - rndc-confgen. + rndc-confgen.

-k keyname

@@ -128,8 +127,8 @@

-p port

- Specifies the command channel port where named - listens for connections from rndc. + Specifies the command channel port where named + listens for connections from rndc. The default is 953.

-r randomfile
@@ -147,61 +146,56 @@

-s address

- Specifies the IP address where named + Specifies the IP address where named listens for command channel connections from - rndc. The default is the loopback + rndc. The default is the loopback address 127.0.0.1.

-t chrootdir

- Used with the -a option to specify - a directory where named will run + Used with the -a option to specify + a directory where named will run chrooted. An additional copy of the rndc.key will be written relative to this directory so that - it will be found by the chrooted named. + it will be found by the chrooted named.

-u user

- Used with the -a option to set the + Used with the -a option to set the owner of the rndc.key file generated. If - -t is also specified only the file + -t is also specified only the file in the chroot area has its owner changed.

-
-

EXAMPLES

+
+

EXAMPLES

- To allow rndc to be used with + To allow rndc to be used with no manual configuration, run

rndc-confgen -a

To print a sample rndc.conf file and - corresponding controls and key + corresponding controls and key statements to be manually inserted into named.conf, run

rndc-confgen

-
-

SEE ALSO

+
+

SEE ALSO

rndc(8), rndc.conf(5), named(8), BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -222,6 +216,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.rndc.conf.html b/contrib/bind9/doc/arm/man.rndc.conf.html index 2a3aa393e..877c1e4df 100644 --- a/contrib/bind9/doc/arm/man.rndc.conf.html +++ b/contrib/bind9/doc/arm/man.rndc.conf.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - rndc.conf - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,10 +48,10 @@

Synopsis

rndc.conf

-
-

DESCRIPTION

+
+

DESCRIPTION

rndc.conf is the configuration file - for rndc, the BIND 9 name server control + for rndc, the BIND 9 name server control utility. This file has a similar structure and syntax to named.conf. Statements are enclosed in braces and terminated with a semi-colon. Clauses in @@ -78,7 +77,7 @@ The default-server clause is followed by the name or address of a name server. This host will be used when no name server is given as an argument to - rndc. The default-key + rndc. The default-key clause is followed by the name of a key which is identified by a key statement. If no keyid is provided on the rndc command line, @@ -114,7 +113,7 @@ The key statement begins with an identifying string, the name of the key. The statement has two clauses. algorithm identifies the encryption algorithm - for rndc to use; currently only HMAC-MD5 + for rndc to use; currently only HMAC-MD5 is supported. This is followed by a secret clause which contains the base-64 encoding of the algorithm's encryption key. The @@ -122,20 +121,20 @@

There are two common ways to generate the base-64 string for the - secret. The BIND 9 program rndc-confgen + secret. The BIND 9 program rndc-confgen can be used to generate a random key, or the - mmencode program, also known as - mimencode, can be used to generate a + mmencode program, also known as + mimencode, can be used to generate a base-64 - string from known input. mmencode does + string from known input. mmencode does not ship with BIND 9 but is available on many systems. See the EXAMPLE section for sample command lines for each.

-
-

EXAMPLE

+
+

EXAMPLE

       options {
         default-server  localhost;
@@ -176,7 +175,7 @@
 

     

 

-      In the above example, rndc will by
+      In the above example, rndc will by
       default use
       the server at localhost (127.0.0.1) and the key called samplekey.
       Commands to the localhost server will use the samplekey key, which
@@ -186,11 +185,11 @@
       base-64 encoding of the HMAC-MD5 secret enclosed in double quotes.
     

 

-      If rndc -s testserver is used then rndc will
+      If rndc -s testserver is used then rndc will
       connect to server on localhost port 5353 using the key testkey.
     

 

-      To generate a random secret with rndc-confgen:
+      To generate a random secret with rndc-confgen:
     

 
rndc-confgen
     

@@ -203,13 +202,13 @@
       named.conf are also printed.
     

 

-      To generate a base-64 secret with mmencode:
+      To generate a base-64 secret with mmencode:
     

 
echo "known plaintext for a secret" | mmencode
-
-

NAME SERVER CONFIGURATION

+
+

NAME SERVER CONFIGURATION

The name server must be configured to accept rndc connections and to recognize the key specified in the rndc.conf @@ -218,19 +217,14 @@ BIND 9 Administrator Reference Manual for details.

-
-

SEE ALSO

+
+

SEE ALSO

rndc(8), rndc-confgen(8), mmencode(1), BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -251,6 +245,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/man.rndc.html b/contrib/bind9/doc/arm/man.rndc.html index 731a560c7..59a1360e7 100644 --- a/contrib/bind9/doc/arm/man.rndc.html +++ b/contrib/bind9/doc/arm/man.rndc.html @@ -14,13 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - rndc - - + + @@ -39,7 +38,7 @@
-
+

Name

@@ -49,22 +48,22 @@

Synopsis

rndc [-b source-address] [-c config-file] [-k key-file] [-s server] [-p port] [-V] [-y key_id] {command}

-
-

DESCRIPTION

-

rndc +

+

DESCRIPTION

+

rndc controls the operation of a name - server. It supersedes the ndc utility + server. It supersedes the ndc utility that was provided in old BIND releases. If - rndc is invoked with no command line + rndc is invoked with no command line options or arguments, it prints a short summary of the supported commands and the available options and their arguments.

-

rndc +

rndc communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of - rndc and named, + rndc and named, the only supported authentication algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command @@ -72,15 +71,15 @@ over the channel must be signed by a key_id known to the server.

-

rndc +

rndc reads a configuration file to determine how to contact the name server and decide what algorithm and key it should use.

-
-

OPTIONS

-
+
+

OPTIONS

+
-b source-address

Use source-address @@ -108,9 +107,9 @@

server is the name or address of the server which matches a server statement in the configuration file for - rndc. If no server is supplied on the + rndc. If no server is supplied on the command line, the host named by the default-server clause - in the options statement of the rndc + in the options statement of the rndc configuration file will be used.

-p port
@@ -130,10 +129,10 @@ from the configuration file. key_id must be - known by named with the same algorithm and secret string + known by named with the same algorithm and secret string in order for control message validation to succeed. If no key_id - is specified, rndc will first look + is specified, rndc will first look for a key clause in the server statement of the server being used, or if no server statement is present for that host, then the default-key clause of the options statement. @@ -144,22 +143,22 @@

-
-

COMMANDS

+
+

COMMANDS

- A list of commands supported by rndc can - be seen by running rndc without arguments. + A list of commands supported by rndc can + be seen by running rndc without arguments.

Currently supported commands are:

-
+
addzone zone [class [view]] configuration

Add a zone while the server is running. This command requires the - allow-new-zones option to be set + allow-new-zones option to be set to yes. The configuration string specified on the command line is the zone @@ -171,13 +170,13 @@ hash.nzf, where hash is a cryptographic hash generated from the name of - the view. When named is + the view. When named is restarted, the file will be loaded into the view configuration, so that zones that were added can persist after a restart.

- This sample addzone command + This sample addzone command would add the zone example.com to the default view:

@@ -189,7 +188,7 @@ configuration text.)

- See also rndc delzone. + See also rndc delzone.

delzone zone [class [view]]
@@ -197,11 +196,11 @@

Delete a zone while the server is running. Only zones that were originally added via - rndc addzone can be deleted - in this manner. + rndc addzone can be deleted + in this manner.

- See also rndc addzone + See also rndc addzone

dumpdb [-all|-cache|-zone|-adb|-bad] [view ...]
@@ -211,7 +210,7 @@ dump file for the specified views. If no view is specified, all views are dumped. - (See the dump-file option in + (See the dump-file option in the BIND 9 Administrator Reference Manual.)

flush
@@ -243,7 +242,7 @@ the zone is frozen.

- See also rndc thaw. + See also rndc thaw.

halt [-p]
@@ -253,12 +252,12 @@ made through dynamic update or IXFR are not saved to the master files, but will be rolled forward from the journal files when the server is restarted. - If -p is specified named's process id is returned. - This allows an external process to determine when named + If -p is specified named's process id is returned. + This allows an external process to determine when named had completed halting.

- See also rndc stop. + See also rndc stop.

loadkeys zone [class [view]]
@@ -267,14 +266,14 @@ Fetch all DNSSEC keys for the given zone from the key directory. If they are within their publication period, merge them into the - zone's DNSKEY RRset. Unlike rndc + zone's DNSKEY RRset. Unlike rndc sign, however, the zone is not immediately re-signed by the new keys, but is allowed to incrementally re-sign over time.

This command requires that the - auto-dnssec zone option + auto-dnssec zone option be set to maintain, and also requires the zone to be configured to allow dynamic DNS. @@ -292,7 +291,7 @@ Sets the server's debugging level to 0.

- See also rndc trace. + See also rndc trace.

querylog [on|off]
@@ -304,13 +303,13 @@

Query logging can also be enabled - by explicitly directing the queries - category to a - channel in the - logging section of + by explicitly directing the queries + category to a + channel in the + logging section of named.conf or by specifying - querylog yes; in the - options section of + querylog yes; in the + options section of named.conf.

@@ -319,14 +318,14 @@ Reload the configuration file and load new zones, but do not reload existing zone files even if they have changed. - This is faster than a full reload when there + This is faster than a full reload when there is a large number of zones because it avoids the need to examine the modification times of the zones files.

recursing

- Dump the list of queries named is currently + Dump the list of queries named is currently recursing on, and the list of domains to which iterative queries are currently being sent. (The second list includes the number of fetches currently active for the given domain, @@ -352,7 +351,7 @@

If the zone is configured to use - inline-signing, the signed + inline-signing, the signed version of the zone is discarded; after the retransfer of the unsigned version is complete, the signed version will be regenerated with all new @@ -370,8 +369,8 @@

Fetch all DNSSEC keys for the given zone - from the key directory (see the - key-directory option in + from the key directory (see the + key-directory option in the BIND 9 Administrator Reference Manual). If they are within their publication period, merge them into the zone's DNSKEY RRset. If the DNSKEY RRset @@ -380,7 +379,7 @@

This command requires that the - auto-dnssec zone option be set + auto-dnssec zone option be set to allow or maintain, and also requires the zone to be configured to @@ -389,7 +388,7 @@ Reference Manual for more details.)

- See also rndc loadkeys. + See also rndc loadkeys.

signing [( -list | -clear keyid/algorithm | -clear all | -nsec3param ( parameters | none ) ) ] zone [class [view]]
@@ -400,33 +399,33 @@ operations (such as signing or generating NSEC3 chains) is stored in the zone in the form of DNS resource records of type - sig-signing-type. - rndc signing -list converts + sig-signing-type. + rndc signing -list converts these records into a human-readable form, indicating which keys are currently signing or have finished signing the zone, and which NSEC3 chains are being created or removed.

- rndc signing -clear can remove + rndc signing -clear can remove a single key (specified in the same format that - rndc signing -list uses to + rndc signing -list uses to display it), or all keys. In either case, only completed keys are removed; any record indicating that a key has not yet finished signing the zone will be retained.

- rndc signing -nsec3param sets + rndc signing -nsec3param sets the NSEC3 parameters for a zone. This is the only supported mechanism for using NSEC3 with - inline-signing zones. + inline-signing zones. Parameters are specified in the same format as an NSEC3PARAM resource record: hash algorithm, flags, iterations, and salt, in that order.

- Currently, the only defined value for hash algorithm + Currently, the only defined value for hash algorithm is 1, representing SHA-1. The flags may be set to 0 or 1, @@ -442,13 +441,13 @@ So, for example, to create an NSEC3 chain using the SHA-1 hash algorithm, no opt-out flag, 10 iterations, and a salt value of "FFFF", use: - rndc signing -nsec3param 1 0 10 FFFF zone. + rndc signing -nsec3param 1 0 10 FFFF zone. To set the opt-out flag, 15 iterations, and no salt, use: - rndc signing -nsec3param 1 1 15 - zone. + rndc signing -nsec3param 1 1 15 - zone.

- rndc signing -nsec3param none + rndc signing -nsec3param none removes an existing NSEC3 chain and replaces it with NSEC.

@@ -456,14 +455,14 @@
stats

Write server statistics to the statistics file. - (See the statistics-file option in + (See the statistics-file option in the BIND 9 Administrator Reference Manual.)

status

Display status of the server. - Note that the number of zones includes the internal bind/CH zone - and the default ./IN + Note that the number of zones includes the internal bind/CH zone + and the default ./IN hint zone if there is not an explicit root zone configured.

@@ -473,11 +472,11 @@ Stop the server, making sure any recent changes made through dynamic update or IXFR are first saved to the master files of the updated zones. - If -p is specified named's process id is returned. - This allows an external process to determine when named + If -p is specified named's process id is returned. + This allows an external process to determine when named had completed stopping.

-

See also rndc halt.

+

See also rndc halt.

sync [-clean] [zone [class [view]]]

@@ -496,13 +495,13 @@ load has completed. After a zone is thawed, dynamic updates will no longer be refused. If the zone has changed and the - ixfr-from-differences option is + ixfr-from-differences option is in use, then the journal file will be updated to reflect changes in the zone. Otherwise, if the zone has changed, any existing journal file will be removed.

-

See also rndc freeze.

+

See also rndc freeze.

trace

@@ -515,7 +514,7 @@ value.

- See also rndc notrace. + See also rndc notrace.

tsig-delete keyname [view]
@@ -527,7 +526,7 @@
tsig-list

List the names of all TSIG keys currently configured - for use by named in each view. The + for use by named in each view. The list both statically configured keys and dynamic TKEY-negotiated keys.

@@ -535,15 +534,15 @@

Enable, disable, or check the current status of DNSSEC validation. - Note dnssec-enable also needs to be + Note dnssec-enable also needs to be set to yes or auto to be effective. It defaults to enabled.

-
-

LIMITATIONS

+
+

LIMITATIONS

There is currently no way to provide the shared secret for a key_id without using the configuration file. @@ -552,8 +551,8 @@ Several error messages could be clearer.

-
-

SEE ALSO

+
+

SEE ALSO

rndc.conf(5), rndc-confgen(8), named(8), @@ -562,11 +561,6 @@ BIND 9 Administrator Reference Manual.

-
-

AUTHOR

-

Internet Systems Consortium -

-
@@ -587,6 +581,6 @@
-

BIND 9.9.8-P4 (Extended Support Version)

+

BIND 9.9.9-P3 (Extended Support Version)

diff --git a/contrib/bind9/doc/arm/managed-keys.xml b/contrib/bind9/doc/arm/managed-keys.xml index 51949487f..d1335eaf4 100644 --- a/contrib/bind9/doc/arm/managed-keys.xml +++ b/contrib/bind9/doc/arm/managed-keys.xml @@ -1,6 +1,5 @@ - - + + + +
Dynamic Trust Anchor Management - - Dynamic Trust Anchor Management BIND 9.7.0 introduces support for RFC 5011, dynamic trust - anchor management. Using this feature allows + anchor management. Using this feature allows named to keep track of changes to critical DNSSEC keys without any need for the operator to make changes to configuration files. - - Validating Resolver +
Validating Resolver + To configure a validating resolver to use RFC 5011 to - maintain a trust anchor, configure the trust anchor using a + maintain a trust anchor, configure the trust anchor using a managed-keys statement. Information about - this can be found in - . + this can be found in + . - - - Authoritative Server +
+
Authoritative Server + To set up an authoritative zone for RFC 5011 trust anchor maintenance, generate two (or more) key signing keys (KSKs) for the zone. Sign the zone with one of them; this is the "active" @@ -52,21 +52,21 @@ also in DNSSEC section above here in ARM --> timer has completed, the active KSK can be revoked, and the zone can be "rolled over" to the newly accepted key. The easiest way to place a stand-by key in a zone is to - use the "smart signing" features of - dnssec-keygen and + use the "smart signing" features of + dnssec-keygen and dnssec-signzone. If a key with a publication date in the past, but an activation date which is unset or in - the future, " + the future, " dnssec-signzone -S" will include the DNSKEY record in the zone, but will not sign with it: $ dnssec-keygen -K keys -f KSK -P now -A now+2y example.net $ dnssec-signzone -S -K keys example.net - To revoke a key, the new command + To revoke a key, the new command dnssec-revoke has been added. This adds the - REVOKED bit to the key flags and re-generates the - K*.key and + REVOKED bit to the key flags and re-generates the + K*.key and K*.private files. After revoking the active key, the zone must be signed with both the revoked KSK and the new active KSK. (Smart @@ -84,7 +84,7 @@ $ dnssec-signzone -S -K keys example.net "Kexample.com.+005+10128". If two keys have ID's exactly 128 apart, and one is revoked, then the two key ID's will collide, causing several - problems. To prevent this, + problems. To prevent this, dnssec-keygen will not generate a new key if another key is present which may collide. This checking will only occur if the new keys are written to the same directory @@ -96,5 +96,5 @@ $ dnssec-signzone -S -K keys example.net It is expected that a future release of BIND 9 will address this problem in a different way, by storing revoked keys with their original unrevoked key ID's. - - +
+
diff --git a/contrib/bind9/doc/arm/notes-wrapper.xml b/contrib/bind9/doc/arm/notes-wrapper.xml index 9d31ef8b6..db5f01c19 100644 --- a/contrib/bind9/doc/arm/notes-wrapper.xml +++ b/contrib/bind9/doc/arm/notes-wrapper.xml @@ -1,6 +1,5 @@ -]> +]> -
- - <xi:include href="notes.xml"/> -</article> +<!-- Converted by db4-upgrade version 1.0 --> +<article xmlns="http://docbook.org/ns/docbook" version="5.0"><info><title/></info> -<!-- - - Local variables: - - mode: sgml - - End: - --> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes.xml"/> +</article> diff --git a/contrib/bind9/doc/arm/notes.conf b/contrib/bind9/doc/arm/notes.conf new file mode 100644 index 000000000..f8dd8326f --- /dev/null +++ b/contrib/bind9/doc/arm/notes.conf @@ -0,0 +1,3 @@ +TexInputs: ../tex// +TexStyle: notestyle +XslParam: ../xsl/notes-param.xsl diff --git a/contrib/bind9/doc/arm/notes.html b/contrib/bind9/doc/arm/notes.html index da38378d3..d0639bc21 100644 --- a/contrib/bind9/doc/arm/notes.html +++ b/contrib/bind9/doc/arm/notes.html @@ -17,119 +17,112 @@ <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <title> - + -
+

-Release Notes for BIND Version 9.9.8-P4

-
+Release Notes for BIND Version 9.9.9-P3
+

Introduction

- This document summarizes changes since BIND 9.9.8: + This document summarizes changes since BIND 9.9.9:

- BIND 9.9.8-P4 addresses the security issues described in - CVE-2016-1285 and CVE-2016-1286. + BIND 9.10.9-P3 addresses the security issue described in + CVE-2016-2776.

- BIND 9.9.8-P3 addresses the security issue described in CVE-2015-8704. - It also fixes a serious regression in authoritative server selection - that was introduced in 9.9.8. + BIND 9.9.9-P2 addresses the security issue described in + CVE-2016-2775.

- BIND 9.9.8-P2 addresses security issues described in CVE-2015-3193 - (OpenSSL), CVE-2015-8000 and CVE-2015-8461. -

-

- BIND 9.9.8-P1 was incomplete and was withdrawn prior to publication. + BIND 9.9.9-P1 addresses Windows installation issues and a race + condition in the rbt/rbtdb implementation resulting in named + exiting due to assertion failures being detected.

-
+

Download

The latest versions of BIND 9 software can always be found at - http://www.isc.org/downloads/. + http://www.isc.org/downloads/. There you will find additional information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems.

-
+

Security Fixes

-
    -

  • - The resolver could abort with an assertion failure due to - improper DNAME handling when parsing fetch reply - messages. This flaw is disclosed in CVE-2016-1286. [RT #41753] -

    • -

  • - Malformed control messages can trigger assertions in named - and rndc. This flaw is disclosed in CVE-2016-1285. [RT - #41666] -

    • -

  • - Specific APL data could trigger an INSIST. This flaw - is disclosed in CVE-2015-8704. [RT #41396] +

      +

    • + It was possible to trigger a assertion when rendering a + message using a specially crafted request. This flaw is + disclosed in CVE-2016-2776. [RT #43139]

      • -

    • - Named is potentially vulnerable to the OpenSSL vulnerability - described in CVE-2015-3193. -

      • -

    • - Incorrect reference counting could result in an INSIST - failure if a socket error occurred while performing a - lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945] -

      • -

    • - Insufficient testing when parsing a message allowed - records with an incorrect class to be be accepted, - triggering a REQUIRE failure when those records - were subsequently cached. This flaw is disclosed - in CVE-2015-8000. [RT #40987] +

    • + getrrsetbyname with a non absolute name could trigger an + infinite recursion bug in lwresd and named with lwres + configured if when combined with a search list entry the + resulting name is too long. This flaw is disclosed in + CVE-2016-2775. [RT #42694]

-
+

New Features

-

  • None

+

  • + None. +

-
+

Feature Changes

-

  • - Updated the compiled in addresses for H.ROOT-SERVERS.NET. +

    • + None.

-
+

-Bug Fixes

-

  • - Authoritative servers that were marked as bogus (e.g. blackholed - in configuration or with invalid addresses) were being queried - anyway. [RT #41321] +Porting Changes

+

  • + None.

-
+
+

+Bug Fixes

+
    +

  • + Windows installs were failing due to triggering UAC without + the installation binary being signed. +

    • +

  • + A race condition in rbt/rbtdb was leading to INSISTs being + triggered. +

    • +
+
+

End of Life

- The BIND 9.9 (Extended Support Version) will be supported until + BIND 9.9 (Extended Support Version) will be supported until December, 2017. - https://www.isc.org/downloads/software-support-policy/ + https://www.isc.org/downloads/software-support-policy/

-
+

Thank You

Thank you to everyone who assisted us in making this release possible. If you would like to contribute to ISC to assist us in continuing to make quality open source software, please visit our donations page at - http://www.isc.org/donate/. + http://www.isc.org/donate/.

diff --git a/contrib/bind9/doc/arm/notes.pdf b/contrib/bind9/doc/arm/notes.pdf index 01b320bfb75b64cf4ac7b2158f16850791f65c08..228070f438e82ba09c3f57506acfb3a60994fdea 100644 GIT binary patch literal 43434 zcma%hQPega;(Gh+1=jq4p%repChg_Isdp`bU zn;NE|>E)psCV4$geI1V%6T}rw{0&&oq2Pl`qJ69>Ifu@c+B80VUVhTH@x>i-yn0rL z*eoc8+|zsH$K9Ux@8>ycm}KrSKL(i~$wfonpm*WcW9>{;QMYP>k)Pt#Fw2&)(B}!p zpU$oYA*eQ8v-K>lEAN;MYdy3NYu9NuJK>UMCFKvb8|Y`@%34HCg0M9?I2Id^a|{`8 z&{bEtq0IZ#rD*HdTe^-;*P(ia^A@Uz1EZ>&Qls@0AwsQZ$EOP-jV=*PK3Q5cihvk@ zVuZokJsK;T2%`iWlt>;bjFhG46*0j1$2GyI)tS^Uh_gsFcbUEV)kceo6xUQPOf>8< zIV+DTOqC&tCu6xZl(U4n6^`HcYb~&4+s*<*^KrQ6lc_=kb21O!TG3{$FyO#$bwE6T zJ7U!9V6>KS2Pn6Plcvio@?%f>M!goxt;#IZeW`TureAz z_I%5;{_#5SZNjszZKoeU>bnycJq#C0Eo|Yg9Ye*Hi?u{Nrsj}=P{%Sol>xbwk-9Yj z*YiAnE2?XB#TJc}Ew?meS|WolW?Tdaw$(uj3ZykDZ=4iwlw|+wAkXu=EsBbhy9$(c19*6Ef_x;~x?nqlZ1%$@(v!|d_A zwJ%jNQgmk7YGT||t5NF_MGtE`QevX6@eDq~SSUNB#oKy6oB)#uueG?5%Z00^r3byA zgR3>2PTNdlb#Yjn7ZAd_fCEAw9laNVqlZ0Ko$?wlQ<+bgY*pDKcqWJ?{#y!H%=&V6 zdACd&vvg#K(Qnwp2g)~*7xx@>-J+^P=N49x@atW;0*qygW7`m#>{>c@&rqDIBRk#M z1AlBZw$+vu;%;jt3|>|onHT`yv67f|mA_WU?f6l2xzKec$sPyUZFz+@K-U8RHWDq7 zx;2tqq7aYSGb79zpJx1~h}%}{(hWHgw-`)bxNV4xCufnv2V*c?PU0EdV&7HDt3J?T zqwaeC%i-PlxRw+U+{vZ(D6Wg5;HUk9O#NXchq&Wd(*630`qg6lrU3@EOC>Cb0YHS~ z;;3vrGm`3uF6%|fMJju1;%&J43%0~B&td4jRpSq+3YVA8;z$+i&BI?7FbahY1Ldj+ zDloj@*;yLjJ&0Ggw?L#2`5M!rFP8`DX#^IvC=Ip9s1><)DT2(Bs=-Q<2?rLLFP>B{ zdCE}!7594VIE^zYxj5Vch4uKX_NC((b$9i3c4fv#y?^CX@`w|oRsG4n&R&$&XA=Qe zs~CJ^Z#E_dZ}=Et$D)w(-LK{Gk%E=`H&i9~g35`JW4s(J#)DP~NC@55gmz-* zqlIdoy1=&!I_eDv>KC8*JB5>bb1GwuQcz}?4BUs~vI|#*g!f9!wz1snVSV;qbGjBJc7|6?Oe|Ed4*Ka!b% z;eRLrBRdNR%m1gr)N~lTm}$3=;i%eh+uLllX)21^+i+K|x7l)|s@gOgZL#%noxR>{ z9l8Bo*85*GzGiuxGB>Vjcqb!MSN?;>-onh3Sl{4UVrFJ|09aP-qsG+I#>UcKpInSy z*Te??joL7roD{{Cg~_G8wi$)VmGuDFlZ^p1A`<|Bh7QQg&c;r|A+R#PJFqY`yM-zE zj24uYmVVPu@|OV+!~3iJxVkVgG=na9|2niXvNg9iHoE#oKm6NNTp0n`x3L3aXl-Bv zjG&^jl%$pbsvtpK223JrBZ~`L1t3KywuUAUm;3H_*cWov101>(r=;Qm9No&YhhIWV!eJ%3<-)o1V)kM_6h;Lu#p z`auWg3Mh`uEG%wpjZ9wB&*)$OQ#tE@1o@`lz~0=__Wr)IeXC#jJ2p7DHZiiD0+^n8 zWG7qru(x4`*47yF7ZcrFU4|Q&dB%4#M*sR-?#$x&)h4L&Hw*iuhZHvE*0zQZXpE$! zDGthg+Diba`s=1+{_eMa{0m0=OYWSDF`8Of5JNNES_bZ5q*ys%IvB=!q z3~;WQnek`W(eKltx#9Z@kN5{_^jqKBQ`lS_$}Mnazv<8WC;98o^Vja2Oz_+k0iSU>F4pags=tBHH` zm zUp{SKuZgm^4l{UzoQhf=ew6+U5GdkxJL2<`cU)lvQM{6nESc5E%RqA>^JqdSIGzjf zpOK;^lVjtp&J(fZC*aszHUkSXEQU75C3U(&LHJTy^~U%`VJ;rhbJsd)xY}wycn(9 z4io%A-Cymk+(DWp;f1u_FQ0C?DzD_Z$!mI&otNn_mjEQ?!80eKZ%i?nii5Y;>9Hc^ z-8Xz$VF&9@WD8TWY?M+QesKyu-`u{)#<&U;lZSA8(Tb7?t-*LvC!HGtXo{wh>c_lt zuciiOLNQ;2q-8dRFLA(l_MceHP~3hmH4l5!P6SJ2*%vG`$c{qq5#yN~Qk9(9qVsbe zb6Lfo?aa$&qz!2vLpkwU`9)gf`eBau3#cXyLyTL2nd)HJ z(Z{EjK4w8bFhOLKnA6d45N@HnHe$&>_)$ApWTeVGbiex3d4F#?>&8nez)dlEyF*67 z6vrV*I{`DJJ}e$vQQ99AYW^S&@|qd6r%dYSY;tH)F)1PDV6lS1uZ0RLvf6~Mvr;b^ zZa4MR8Dx!@K8KiOzg#Ey!^K5GB^s6od|lN2sO4c7zwV6910gLD=+)9a$Lz+UCOyOb zw2bxA_lx=|#Tk;N6AU>jw7iC$H`QA65u$){7Z^f2ckonsEm%^j6e?FKgEVp#g9x;+ zD0}5`8M(a^>XIfB5%Sf3xtwgO9O6I04L78iFNT)@x=aOY$>0&RpYZqq6nzmoLZT8t^sO#QLYz7L z4{(_!t$Z4%AUXTGJd&8Vyv`gjbsIIraGF55{m&39!G-~EpNETYRk8SGEU2XHInauw zaKna^biVk0g<^)u9t=pcIyPn3i9X8(t0BX2McF><@}s=|u$3eu?KTST(VSL%{D>Op zJ$v+e-%ptlpm~r_M@h)z{PmFeTGYrEsR=ZXa&8RqB6c_-<5)C~e&frIS-~XHmh|k^ zz*8V>S`5*g+*0f2$Kr|Ulortmb2Un+?2=e zD8|_6VX6=&lvIbibKFje`Q*eI&zjw3Zv30sJ6)KDn{3@CUpZRV^)&E;=!o8~iUg_< zs2J@`PCcuQjzLGfXi;?ZUmqKu0;{pWLbU$B6ng}#!Xz%{;{<|ubifUTlUJbOhbHRg z>nyq2%b(OX3_w3u_E4KS?<_a5E7_8Sj@a9!tXZW$+LA|_n{we4#+B!UJ{;3 zCmR}+Xw#*dyGKuHBZOOvDAn9ATS}4OR*F|6W`Q-joti@D^VVx;SZ_uyw_SR=S(Sc% zXIC

sjI!*Ybpr>yf2OGEuAQIDYTg)V9JcsHyO#o6y*=TBjz`nF`lQF`V=)^4B;6 zAHM+ZnD8>7p_a$nT-=NE0hsx!dXHu>HPV~M1z3Bl9)Hjv^$v5OpXmnbG@?3r7#dUAIO0WA!4)s3Zz#MlZK)$K|+x52xLs^r#ejinw5rM8Fqmz`b<);{Uy z!fnA~zysg-)s5ED_GBX!atwb-vylps)63e(@CrjI4x^H@me1&CCD>Tx&90o-wL5I8 z)t`X5j@$cO60Tw0;Hq(q0C?T*j?S4w3daUL?>pw2DLjR(M&e94knzjrw8)1xiNvB&hR~F z7Ds<}rdbr0v3$tkCGRnMp3IaG9X$z!$!xuIm6LguNvprLK;v}w67=x9^hKSF40qwL z)L_KDbdf`}QG1}Li-^HqqZ+C9@LUgz-s2(uV8EurnN&%&s1Ve6pC@S6Sx9i^K$BDr zXg%2|PsAZx`7ImnIOlTxEM9Oe8>vq zOrHZEcDP@FSh;8&Y$)`z8Q%mGgrcHi`;Ac&itnhfGL@ z)&4jHl_u%ppyPLwc2+JKQ1m0P>Q(OPg1Igyn(xDXn-(<4IV?#+jJM}Y77`+4`39?h z8ALEYbxCONB)<2Yr;9BQ+||Q2Ml9iYrh#=T8AQToRM~jn&_H2glcXTGnWcKuZHL&b7{ETV2n+eFsq35 zpNOyG>9reW@CR&?5f!y_;gOz#6 zyR|U~dGZ_d+}xCy2jedA}(A%Pddj zlHp;d9ponS2N4IAY)V4y?#b3!`T};nl@TKt7Ac9$+OMji# z=b46rOUWG?NvW8Q(+UGPQ{PY)6lkrSw+ZDbt(^O5L7jUha~?|g_m#h4p3TKaD74j_ z32Lzg&zPMhl8N;_L9mPYh8K9~?lO>sn}#5(E&KqrM8b^di9>zSk=9}x^rm8b2+c9_ z?hsYcE@nhK(wt#0M~EKEDO45q`+H4i_R-*(nAIp>ERG+c;Z$JZHDx2!{up+6i-I+$ zH<0{!-}A%^b-t~=wf;pTM$?Q_O$V{iSl3%BLs8tTSPqDq+oo)65`vAtLRh?4^%Op9 z@vA|_W}Ih{Q7Vxz?feUi6SRw*;fp*(@_ZX`c!m3T%XGNp5TQDYfM7g^T<6DtjA4Ar z$-5Z(K?F_6`dO9|185@?yubJLFK6szlf44W`6c~STSLn1@4E|BGg0~-rr1+`VJe8M zB|o%5$DN#SVHQ-G`h1R+w)KBx6wwIyFAE967@DEJ~F?e$*JSnV#vz7x}g`r z6aR3WuOB69`TEqy*L}4mkC-YTJ_J(KMIsGNZ-$$zfE#tb4cH?Oa(pOgOG2eMsS!GI zu0i^YJF|{{ZEUe8rB<{RhkV(T63K zs=)6>=`z^u_TyYt=pnFFGS}m+SfS54=)6|p!hWBa{>v&Y)JAy5KAsFL*-yi~;9_(u zK?keuJs8@tfKM2svIM&e_zWsb^`$i|!bqNo4pYGTnPYp`c55m%4hk7g-zcUkhd(?C zs-X6HAutAmk(qA35inCcg2D^zz?;{@%%9J8X?Q5v zlOj~axHb>z-s#;~lIQH+$1OiBYdJkaHN#G_bmTrVnlQP^Wk+njS}6ZMBJn*TC~1pJ67ZAlbc! zO9_0XM8xB=e-6mewc_uw*$%v)e; zm!sWv#e%}|ey9C^hu9YZGgj;NDM>4Mey!~%wdpO zTmf&Rnr~&n%F=Smfd(UnyNK@5A$Et66P}D4Nd2d}}+6PT%)qm-1u_9+6eL zd>KHAMG#zNK7g{TP$h`HnuK$wltSPfFKHXcJA}r&6w!4`#MSdl4}DQ^DBk)#m3zL= zt5o9i4nporx{=cRXu;E=rXd3)`ykPwotNvqw_sBtBc)0hFh{WbGvtWiesp9z4Mn0G z`};)~D8BXxm^$F3xuL?JFcWhp1zUW9g4|-misEDLKU7GTw1weFv_a zHW^Y}aWp0%x;9-55lC9~_JqGLS+3%$(tG19Ro?ou-NvDMv z8Ci*JCl~W561k$I0oB+7a5-&9FdoSG(<7ea=f8gi!p4COGToWlvS@aL;IqLY@!7{5 zrBi5ld!w1OhjcCXHgnEmAcKY1be3(ML&Ds@+b-kY+h^kl&aCP*dz`;&pYT2Gp^MNN z8BC53TY%nG@R0e7OHg8qHY!Uaq^VrJaYwlv80Pr8T#^PdsKjM`GQ@r!Ns-5Pxr~B9 z=iJm@y5}E*(qaXtv~O0`x!D}YhQZ#@&sz|` zoa5$-#JJY-<%#eq&q<3mXpRBf?+!t%K$q{aFmeEq=KX_#-tG?#Eia8ApoBv~uw>7V zoH9Iq>Z|KDQn|pf>CPstIcEiVOxAV61qgFc<>ym2D9wxJ^9~pkP%O^T};VZ>_YSO31=pjwU|cQkm85CYZYI+ir7V+GPs&d1^^* zrER$c_nfU(XYJq1mINVWI$lPxzT}&=_jVV?Da(rn9q=Ys6>q01O1qg0oFs2|tJp=C zBKGC-ov0^?4~LeO9t^ge*mbNtX0xw~qCL-de-TCn{DmFJGj|8f-duM25RgEQ1#lXF^8YT0b=E@6z5}C|G|B4HqBOg> z&i5_V_OQr=aLCi;-#atZ&B}6(ySOXKr9+3tPD&H(!H7pg)5ghu$tXQQj60cCRRbTb zh2ZA@^;HJE{u?XH<;EoEx=^&u?pF`;Dtj{Stqq?>c1eBsu z%!xO6Mk`Da4}CViC(NlVS+_pug8}|Qm0(&9l$42kcZzKcQuIKz#=fSNdl1={{sL(- z{+1#Bx9NS>Mh;xRsn1Ub#hCi{ZPlNxp5nR|;e?SJrixK2c`Bm0zzHs)oHw6&UmF<% zi;x6aGo}GM#{Gf=$z;{=IMa9|8+Tt$TLwbUTd3bz70Us&ITpc>0xkCvZ1{OPx{XUB z0_l4C`^mxn)*O&+)x~70%kwaa&Rhu#DiC$J+|H0(LuvQb5AS#AcQj@n<`uEyn<^8K zg_1yQdE=v$d0bM5n$<>4Gbx@xm0+@DIicf`$ZDCJ!y;@^u!~bOFE}VCci7CQkPzpc z0MpY=XllyxRm(h8vcU$Gm!k&xjgM|MR~X8;j(fA})rFZ;rj-sr>v7f+ym}i-3Ox&z zb}f4~)iEYt_oI{UY{AAFAN)Cp&lS)4D`g1gJ!&*ZZssRyr%ntuAbTbiIh66mD~ANvSBi-M_b6L!KxaTa7S=|~u=>m6 z+Qc@sn~O=$jtB&8q*VL{6O8`C1d@UQYbd#bl%Ns1U*fzxz4|#Fc7t+*v!r0-&nE^V zp0J2og+WHeBPrH{DrFap)9oXQ)FA**GcnmpY`kl(+;aJ$$Jk(FXoJ#?Fm4LnZw#zsJQrR^obgle$b_1BTI#0<_o9g{Flb6=W` zd1OYePD7@>>-v6FRYX#aVRkn$_Nfjf`aoHeND~oN1dAx6u`BWPCtwDiO8p);YDhcK zIvlG3D?7gt{Zi#D$_G3A>w*Po@kj-72Y41s=pm|=GjB6LFR!s&-mbVshB2v|%kf}GE zNv5MXMQip$`u@b4hl@ASv-T)B_}LLEPRo#O2fmascJFkX@X7G*I0haz8vYv(<6Q78 z&@B3ezhq8vOByygrA_I-G_FFKn}b-40}2AWNJ`*GNL9)iQe439Ev}rP#3MW;NfBO& zA)J%vfy&{#Xs3%iutR3V`fRk%^Nc-YxWyN;hT2fla?iJ{orrCB=KTbt`F=(IkF*>H zLHqZ0=CKV~Ql`XyRs@l_VM%j~*pKW~1+FmRR|;;OB*FpA+Ymk)YT+jf2S-BHvv%$RQoCmGWgXHbtIr0mrN*PeX@mT;nuevoK^^fO`Z7IBb;Z$^lrY-9^!)`{*&>an=+ZenwdB;1LzXGbw@R>ZZjM zI||lEp`Ns|Ou7T+_T6p1r^S;FtNi!eEb0_j7(68i$olc!WkgvI0!xmM@3C$oQdYwe zihnp}9NOagWJIsIY_e>erBYNsV+7J!t2U)oTd^aV&wHJ0XG>`k_REyGtGks6G#gY7W>Loo0r9)?us% z7tz8eo5dbW$21G@k5I95JWpvQpFqI_DK-TuAot~s3^sbNm@02GcqxUdx(twh0fS;G zS4zwq;=%pX#^a*ufQ015=CwqGxaOFj3VsRxw#u3SgJ8W3w8o^uMtfn@&(xTJrTBgP zwtW^pArZ(;ku-!wB|ea>UaO3xRGK>b8%how60SD=W=d0RlYfE(7bQGF&)jX8926-GUtmM?>gT~C~$%$7F3N%d?fb7u# z7&X<#%0?E_#gE{Jai_JB5+l@Bgt7^JDd4?#-$yDm@Y@|_WrlFMwLZ8oLPH02!-P=4 z7)%Sz+$uZO0g^s!QqQ{6x0v-@H`ToTKw@$?wq1i6m(s5Yjr578Y8mY!&1%4VnVr%# zyo0GD(WAdK__-OK-q^%1)w&z3@jwrQG&MY)M*$OR^PVP^0#x=Dn0J0N@rmSM-~%E~ zZ1JN>c(*=k6Iv^|cIC$~3yZc#67=!gp?}Nq_w`&u+4H9+f;c5RHZN1 z^=zpQin>DgyTnhv(I)72ZVb-UKM_z z8nr$pkvG_$Yu58jirF*dImBvnr=MbL-<$v;HFr;1^0`3-0Tr1RvIQE`OBh8H4uFIe zGR6yA-yi9uml^LhkYG>&D4jTjJ9gSHzi&BWed|@?-Tm4thx2aM2fpH#z%U{0rh=_H zYcQ4>>!=jV1?}Bm439=K)aF-i!T2hZwyD3D6jZNb`KfBX-nxqJVW2x|4eP;^!$Bep=;@x;p5I)$xf<#6J8I}}c(0%7I z$3nisQUM(y;ToBU?UoG;V#*#KB_<3x>S39t-+?m}NuX+SvVEuGQ5B=c&R1%&2jH#o zzg5d{sW+YB*+7u`LLe7bcMudSpY=59T{mBz4q)y{nsIoG(#`4Hsf^Z^JCtQ1^szaJ z%;v_TU4pxtw-3??tD5~KW&s>;pU#GZR=;$d?pB(6K%d`a?l6|e*Sr=36^PQu zCS&2P6|&lTJJs|1pO)ScBKvcM*oyTWMt-HyvnoaA8e9z6!Oj26Z++pvc!#GAj)V4u6@h=9UAEu=*@&QS`L3{_~jg*n6*TT8vkbX1OkJgY+`m zn>t)drF3>|PeP2Z42ldg)+LYh-6p*lO*d8~FLW%QjHyI5tD}QpG028)Sq$RvN6(b zel$ENyW4B(+ThEcqQUbn-o1RTH0yE@U7=GTZp85jB|4i+E)5x&;S8+{4kVb2nbOTe z6P_eV7@ZOe8yfPMnVM74)8uZgnHzSXaKYOrJe=VG7hhs}Q8p_lNMu@orS@lsJxvX_ zf<6pBFy}eW@uQhk?^mzemjjHSnRfEqTz8Eu&NH%zHD&~FoMAB^wTFvKoAj?f*@qo> zw)v6V$=q*qyLcF4Ad|akS*UvS5v1by0GJFAAV&7InNd{aU=e?UWAGvL`gAD#YI#eM z*jAMufTkC3=x?D7j~c^4gt=T61=()H;iIZ&?0lxIqVznBY-7Pv`<}c+md07GP#CIs zvH#Z|ASyyTOI9T}u6#4-t{C&a2?5ACFl{ANOHlr~S}f|ZxK&lOO*<`D-a|@kH)xWJlE_>oQm=8E^EyUAdm>LJr`b@)F76zH#AWH;&!c5@Yp8 z|NAu|=%c6p)>HWc1ujXjS8#_K3e5PIneLNUh!YWia#eC2IL58IV8$rvY_0RG8|_jR zdp?fyoE2pK+zl5091>sydZ#keavSb7Q;N3=2T#RX+|hLsn}{z_c@*HLpp*B2&9Y&z z-L*(&AE37{a@*b^#pp7WCBGFO0lb2rXH(?i*_^PZ9#XI=E-A8^5e90XHkjMJqLKUa zAR?z)N~(r@B`w~AulyLcZWFusL=3YT#ZMizk}%uJkCTgZ4GWYXAtM1ZFz)PCocg|= zb+MnOq=%9mm5UxnaibJ>L~nZZj2rAC-#5+_PQ!6bAK&CBd?Vkjwj6`l(Lhudy1;tH zk*E0%b{ZE*{_Pj7`U8X6H8QGx?H9!V-Mi1+F?=`9M!=|kAU+&nTJOq>{gZ%(pFd|ZUBW{$%o zx77XNeTk6V3FVz=LUW2%o|BPNDPW+{k?&)&OqeTwQ4@xRDOhb;)gJ%V9;hN~`l{^Z zD8=9;+-d@Ep~m7z(OL8DSxS4+P1^K&=t>yckO&4{k}k!_Vm3jS?O5!3#}J}eiaN~< zVGtigzalLZp1AjMaiNdtWm>`DIinnWn0ug&RoY&Ib4Xv;;|(jB?kBu_5gg=C z8eQa4TomFOIg~41U$Ot+NXU$5mVitbF?iTcsHT=g6%mQKyImyfLx>eny4?^*>}6!| z)F7DXx|0}i=L`{|kpetS^GIqT)Tvk~Ni^VOsOH>y(9oBg3s&x|W;m-nc}7+N*x%MXy9@r!SXRpMb8cbP#37Oo+v0%H`IA#a z%#2J{*=LM^2Lg`hD}~!*>cRX2X2J+#!v4O9VVZ z9>dKHmBv>Wb_~$wvnV|&CQL;4|Dp>cwnxK4E|Rcvsv4 zmfvUBw7cxicMGoNPiidMx=_9z;Y+h?8QgVc5AnJT&&E?= zP37dsq+|;&FR$7-g5U4Fz1@a2t5bFZ}0IlB95^EXZxBTt7 zQv-er4^>jK&Kj|{Fvta^sXhI9Kn(7fRrgGInEhZ>Ci_|*pR8t=X5hMZ13fv*u;^%1J5qr|p`+1{G`IL7v#=35^ZuD5V^kF6P99a1w=*eW*Q`zinlynYLy4{sNS++t=NNUu zbNP3UmgB zvO3S`QBXQ{SlwcZld4~++X%8k7)Rxc%U@r|Nm6VNw&2u4Szx=PVltHk1udP~v_94~)eDFw@Ck%O0Vo3xFz|H`NAv+9*N51&x) zJ5ataV`r97%}5ocy9D_OVOC<<3OF&YmO&x)rAH>J^||@`Wv(>u7AI@>HqA$nCt}_< zs8BC$Fgvf4>gmA1tNgWnXCNWUr^*$eZ6uN6u&rI%YC5PFvVqJK4`TXIiXMTOj*<%7 zNOkSoDWP&&z%TV2bt8F>K}K_^mMgN#?p_hsGpD!OQP}YMg)DeD3?osB#HpU`328cW z8c~M?_Ssh$Zin(l#NfN@RLECWnQXQHRG^wGw+kfP2kj?8SuVE+i)hR8GBCYkpJwn` zw+0&?k8igFiE^@O`9dG8+HLdJp^A|m@93SXNivD+zZooZl;wU=Ss&OiU$Pkun4f5> zU!4+f+@om*12*(khVgWJ9r`pGkh;xN4FQl46)yJn^pYnpPOxBeOR97dgEZky`mG>3 zNmk-GZHS>31lnR2d8kDcexRJi!$EL3hq!0H_rQn+1U&P-gJGrVdjZkWY##vQOVN1HQdV1gK^m6QO$~+~SFfLecT5>Mq<*G`_GywZqkzDMDY}x&PnSUe8b-(OXDj zK>>Chv;^zE>f4u($ojD-f9(<-;O}b^VOzT<(i(L(3(j86%Vxq#_UBQWG{yo`9})Nm z!&&K2R76omp*1?)gqqWR(`0oVHt&e6W*nbG^r4)Oeb-2FJurjR2t_}$4iidpkBiB` z3Ha(eoAH&5BS0<|j-SINT|ip2D-waRj|SP>9yXr3nm=Jv$FS*TN_j}~n7Q)RT>Yjt z!jFgzTPr1Mj>0lrDbMPWeQ29h(ZZYG^s%Q>Okjh&;b_IqG3;cLmT%w_t1XOCJLSBT|3AGj+J_H1~x<#x3s955z14?UIplKABh!^^0s&8@!0RoQYtDaeVu zQHa6_(AzFmon7$yzp92miVqiqOiXPn+p(bS{rF_92I93BBB8V%cX*R|MV~F`*B*Jg z-df}eH>Sb~lZhu?lY=0$n+P=VyP^)X-PC?4ccnYOZBcGJ-)a9GxokWk9Ft20_l8{# zB!uB=Ck2RB3bEWp-;ZXC^~${UW_J&TEIVT3sX~(aVX^%guLlFEuTNhIoK-gY1%scE zWGphIVf|gI2=1Io%NHi@8ddu}rAre7!tp^ig09G+#!ZX2_Z~n~l>(l+M#q4)rwzG6 zk>7H3@RakH#y8t9#%FBLCkROiWPa z&4|<441FI2^YeM6(I=Xa@TgbuaIUTd#6kj7b6RWdq8wQH*XnU;-rhvyqM)C45{4>6 z!kSK|EVZPdd)50v#9iE$eA;EGJyL64<+$bL%S??+gNqEW3?*l-@m_Wz^1~K8EBu45 zC;7{GLmsWt9;mS$*ammQmw^>(4GH!Y^pm>68#Z|Dam*@kCE2@CQxikOwXUoOA2KeZ!^x;)ZcIA{IA9ZK-gHsLE7g|T01 zHY$lYi53T)XcAPITW97K_iuhw`>f?7I^`4zoHu;`Zi*IbbryAKvBy)KjC(>@=xn4P zw2wRphb(?Krg&BO8N9eSskavEYM$PtFU=wqsj-9M0r&6Mq)jsrW6Q-w<^AGqi1+0; zY5V_m&XF2#NeNtS`rfNPB;7aG6~!_wN6;GPYVZ9dEbH_zYI>GoL22yq<^Q7z&yf_Z z-@C8AUG8=wF80%LhV+;E>9vRA#jXhG06*^kGXM?<9lv<)!x@W{`T6R3eV7w@Z0(>*C3Rcr@PcK5=($@%7`i6_i*S6#YukGEKltjsvZ zxL-CI@2#(t53-5%Q4Y!KPi%BmePPtB|YncxJzxeJ#p4n=P-m- z744;AUz6HBaKLfyrn(_t=6vmRe*PHmP7c!b0c>^(YT0)tyS=t@z0UV7eh+00U#kT{ z2ro`;oL48Vwjq`S=hJZoc`M9`v#3*YLRsgXS$Y8?e}Aa48UnUiX3LK6z!R~|QN}D7 z4CXdosJmr!p*&OM$cTo?Veju*j$m-o+Ak?w;Zf>IXyjb6+J8*V=l~@vPhWHXkQ{F) zt}c3o9<(@$x!sGP1!{+>Y^H=Lb|7p2(}7-=`WtJZ(i!$<>I4e+AvWa`S%z24tQiXT zNxj9;#ErP%SJiU6g~b^ggh zpJtxyA3GYGsa!2}3FlUHe-OXXd*SDQsl zB2AAxWz^Ug$M;0*G=ZVHr%apOH#$&M%M%kHK$*LJ@=EZ~W2_~8>&x$z)ekAD>0Mc2 z2-3|9+X?%X7O^$9UnsP#n1dc;D0;25@peUxP99k3B6q2!(GUciT|{_*Wn@?tiT2NT z0e=G}TO%zQx!Ov@36E`nSfKV_t)f%o-(k*h0cfQLl6yq%J+KQfb_GIt_v5<98e2HU zow9XIEq5Trd~Q+;JAi%qVg+v$G@dQC6@$?AkQsZm%zbk;YTav%Zg27=lBen~Lr~l+ zrzX_84;-8vntN;LF;VdPh&+*m84vpeR+$Ji;!|}}oH z*!uB-WJ*5IGMQ>=uQ@72UP)FDj%A73fE9M?n@b1F4f&#QjWsQ=2mE3R`YpHGMXRRGI=XG(omrKiDx8)~P4S9X`=)MC?ito7xaVCa#B23N7C3dPNTooCsX z}Kp$$c>t z6nDYstJ3!c{x$nf%v91l>=1CBI5*l4$b?K|--M7S@R-sUAp5RQ9A|7$K}U;I@jD1r zEYDuEw48h21?tsegXynKP`k>44QjPygQ6k1Kz+C&nEcekFK~_N;J0cAhz*-lZ;z zy+n%&Dbw;_OJS|kIMVoq?G5SOd_iF#Ni_dZ|&jb*BX^)KSP zr^k`7Ku_@?g{s|A9mp_2re1wi?YWbas~O9YCuvf*k&{4Q1CEH~MTpr;^RTLR|D#DO z!UW0ag-M;sxL2YHzgBA1a~4TmfpZtX>B5DQ&`{+C&ESjMvJXh+|gZ0Jub1CIBG$*HzwRDOXN#CC92x;anfLzZabam_UVd5iOL$DW! zS`33@2RyXfvjQWCXrfN`Lm2N@Pjun@M+>eiTH$=_aStVDe;Cy#-1oFw$$m{HI+}qt zt5TSmgSJ-$+4gmiEKIJ4q&rN!C&6R>rTV`{Qd0ykWtmmF?ux8B$4PricscYsIabef|_9B;ZWINOpIs!Lw#D7Px z`3UvE)tOA=z1SuNj^B?*af1j~#wLQCGbDJ4QS6~?(#zu@1@mzlO42li6(ob)_lq>s zWpPUlz_~vMo2MY_PwUURh=O-JL!b(0%zgbay+wU&!59PcxZwbOd;zh6R;mRhQ;W!e zY3q44?h(B=h;fk-WJ}y3nJm=|_<&UQ@R9s(XH0`qk1i&E`vI%rlHvKHjaxrsjY(RD zufmI;;lb#bC&PL7ih5VK2x!5K;Aa0_NV#AtZFMh2w&PPWxc;EsMFc4_0f z=pMs=Ht_Up-4CkR-Nk85Q*l?EBIGjZe6(V-;;ML)ygSV*&O*b6CEYcu)RXGmi?7aB zTdp`@u^YFhbdaJY9WWEm>>#W4a|8TKH|9MC6Ai3t^Sd#$?Y9=8Cf;>$+`dzP|jC@P$Yf&PB zr!HXwNoR?bs!TsV1mDFFFmiM;u63XA1ndn*6@H?F4PEKV=1G4@xtHQfC?;o5DxNgw z$J~|}PhNE3>>-B+MDn(Tsol)1?hX?#rypIK(kSzb!6~@IO>>b~s}Em_=R=>;P6O_7 zA%=uXZB^Fc$4(H0(03y~#;vRAL33hCSygeLx0Hz~sRi$6zCXYr<*o^IXv$1MB#Qn- zJ_xzhP_>n+2$%jwRF2ja+uc&Gk8>B2k~FZa-3;~0Kzg>Zb7MhX^KCXV=Aqng$(_0{ zt9T|oZzoh()Vm?CzX4R;n4_=h2Za{BV!kw|!oyMC+PFPca}TMR>xkU1rd_Wc|-UcB5WxD-P03j`l~aqxr+?J#yhbg(O8Xrw_K6 zm~p0PzKFyRl5&Myop}{ENHdoP(Cd5Xq!y)Ki!u8?v>#{(LL z7vlx6laVD??Mk2xMrPe_w9jQ~dNW zM?8G?)dv{yq9FHbm-R6XpF$U_uv*!p9*K%ynKB)AuAP+b-RD}XfuWdX4WvdKPsjQ-ov+PF zBV3xj(I|Vd`2`{9_HbJrK6Y^k9i|lZ>SWNuxf9k3X7Q6VgU@w`Z@zcj5I@Nfbvo ztG{ir!%I=k7MGuF9BQD0x8QQovz!8n?t-Y|=6?}(Prbr0QG0;5ZQHhO+qR8o+qP}n zwr$(CZS_r>Ha+-~p3M)K4A$K1nj4^A+V%3Eau1uWKkrKh59P?svZ|r8@$x|HWJoO< zyJzms&oV9)@35S!sacusKz?e$VrZs_+a>a)t8tB%t-~Yu%MWo3Q^sk!T25#1y?s!ijy=v@B%H2O?UAi55&!x<6j=UIf zQaYqVCGai+f?T6Q0%z9_w5^bgBG}~=`Bx6lr#kzaJ^g*68a|NO!oH$PMdKbkvABsU zFZ;20@5|TW8$B7`Jd|o2U`5z#h`sm??4dpFn^6p_S9 z?SsTl3#^~fk1sOtu|5AaCAOAB{Chb6m1se^;gYfL@@M{gYZ8KYS;_l30{0eTMHkxw z&FWJ5YR9K|GJwJ2)!Sk--#%G(yBdve$7}BEattyV6zqZEMLtZwpOb!Nfc(|@`A)j= zGApwW$8TVIy%|YDs`DKd2A(Y7bmSwW1k5^TpL?l&$BBV8R1}hr(i>XbFDv+Pg)j;$ zKrw^>jR@!eQ(9YTHSS|K8fwOk>GK*3DZ6r|nD{hopbm0^>Ka#SEah{>(u^-pQMaDr ztPF!Vle=-7hnp5ZXLF{mpvp+uoAB8NTQ6rdWef>N7_C9lgmjT2nzUVX6=jc|!fqih z{xobmj&r3tM}h<;|1JC>y<`+oo-j6CmPu&yeVCD}tywe1r}8FB|d&n8rtehYFe7%sEG_RI)HWc3p^}} zTLfjrnOUY)x_-(Hu{dGa!|bF$OU5w0&8gkA4Mh!eX&~W0qO4->ZPR?G$r5i}h_6bT zD&F(cV53#U=$C7vClzyhlPnmXp!Y3U%3X57Y^-96K+TXE2(tRA(WULzv6_Z^_hxQ< zC?kndF-ki}!hS#0v2>2LVB@L3k!U$!{8roq&VnBkM*KMaJ#5sEN>?4w2=o>ei!*du zQ2&A9|0cODk%Z{Dz{j z(h`7SvENK?gNbBPoW!IfBFhpbWF^h5al+O4fWzu{%7r@)JE&>?p$d2kcV3#EdHN|G zaL6j62X)tHpeINFIC)CA@irVnBsRLce9OX9@sn_HgrMX+W?jJz6J00yM05C5WaeFo z#?Sq%J+*3V#lbK_8F&xtCsZPbbmF6?hF_#kuRhtr*xjJT4$IF!x}bCC#a|CLva4;6 zRz$5MqDKItMdR&KH=P)TF!!LasV5JQ|+?{L@^RJsL|M zKTbFDoACR!3K5|3emspFZ0P&G%SG9dG6#tc5x%U@{b0go^jie|6f^YS>gt#=5RJP* zSG>%fIb0jp!wLYaLswXoyLV4jY0v@{w&-oGlKwUV&TbMt7g3Z%HsIAO}iE2w)B z!d=Z;8mOXqh-lTXsA|AFKcNdvybHK_L&eVyq?^IrD=Xgw|vawn^|e zi3KqoF4wfj8k_~{0AJ;8r*|ERsPh##a-)CWs+U#D9V0Y9sOUI(DigbHCH0fyn=g?a zzHniez>>M>g<``4jgSj!w_NHemp6VuV%u636}#vJJhK7#A-nqE$rGcAG`O{X-x_`F z#x~9Y#S_HKdj>`bTj(2HK}ZU-Tz2tyJC1ZF#?0W!TX`!QdhejyT&;!^E^&`gR#ZK| z8d{NFxH{l8Fa!zyQ#O_*qf4Q*n9i(ZnF;gzQ^)8 z>CH@PcQnB{O`k-a4%~`KI()I|P73hmTo#2G8i$Z#emvQ3@A4$NRlU9SVDfHYmefU> z-YbOKi`)BM6Xcip4%15KV31C>*;Lt-8hPzFo<83a_0}D1c5qgV<5c>zb5;bOqByT9 z$^F%(Zztm)*WgV4?NC*isySYU2)V14HM*O%;#@U!CxVeq+rx4;S_{(l>OSIQzYh%H zB@WImk<4gGL>Y;2w+0~C?j%=ht_6=mnV<=B!+#szBprbK^BjdeP{aUJ{1NJeq8i>z ziMR#35P{9K$+=xoQt_yWkl|u$gne4BEb87XvNW9AE8zSv8$YG~Q(!&c+napdwm=dw zp+yXYQcpsJG(5)3X>mXTFe{`(HBR*dJ+vh!^G<;}LJppNe_k#>2fe+4&x&=-#YOiPpNLs}>8L0C@6Irv z0svlyNbNO_zMIihT=7jv#1LPvktOM%E;1Xc6;NqJW#Lz1+?~z(RSypvyQ>F%El}nD zz4*^HVT@0Uy4PlEp+|G#JEJ6U%`k6*6pesUk(fqaS$k|r^~ZQE^lz8CiUaNUJFMLG z7`_x%vHKRp`bb0rHloWDV-=30L%z`u2Xp@X7I|#&wss*|OjxNVV1+oj?Z9S0&t@x4 z2LF9(18`H4Kmnm2HXNnbRO~Fe^353>4MJ5=>Su4B(o`AQ3pD?u`}8h_tea8s_i+bwq;1Zts6G! zyvCj~NY+2Dr0qb&gEM##d!JlG7}pjrMKm4zgNDxp8qhK1eZb`mTw_Z;3=i(|i8HGB zwdBea1Rb(thlVi%-jXU5{{ENaF={+(;i*OoLRXyR>@vHqCSlyYO-VI%GTwaR(Ck+C z_F*}Y|Kfkws~+5|D%{gZ%o6=uR{saXg!6wkO#Uxg!bHHtz{te-f8dh;*DzsX;AH;a zO4k1$$*S%!b}rFvCdJ7@{Tgny-I5a}pNOzkqxx^ys@Y(xu7ujv>$$hpW*@ipQ`PtD zFzWuQWj)8bmWe&b3`bfK$yHR|5k#plIk20OkP;CBpI=d0V`OA)Z3O42V4&hu&kXp@ z>O`cV6v+)Nt0M^aibPf`z~|34k3#^+0$kq!sNvz^fk**(2p6k2OCU|H4ltt+qvh!t z`q%i448-vADL=QDK}R6%1+cOQ?v`H@RD?Uf`$9kb_afp#fUs``3Zmg}69C{~imIzg zY6%e2oJb~sWdZNZ)&N@Gp0OD?4FE;JoZkZ-k7jVN4^#gW2iQM7u#597Z%HTP*C3(` zKn8#=o{xEc$C6)$Isbr<4&0A;ZUgS<@bLu$&;dY`BYUm;_u9V#2++vhH7=+{g&A^sCSw^og;_V3sg@W%xhhvru-lRLfR zM|rWYw~xWEr1s!aa>lw5-?CwDgvu`bgfpzZQ$JL!ypTietVgWbq&3H@ctpunJ8scZ%5*%uw zt)jF2BCd}SJB83($4dNbn}+gQ=)$4F0{2e7suDA$cL-s|xq*9Vhi3sSu?ro{NQsB5 z@I9-9b=1(Mh&9Nkg1)o8Sc=QbvluTI0~`0^3zqkvh(I1Txcr2D;8C8VVCMCu>9zNs z$t&c~3Hu9r*F7E&)Ad{;)@~n~Gm;5IWHa)&*{dAd zEfxu`ej1yY4o#A0!8Fg2$+GC#2$mU4Mf}l)iZ9fIojH@}w8eRWhsYZW7HdDJqD`X7 ztV|{Q?4a;7QnO$coR-}AazKZv72`B%qN(SN04bxRRZR>*`v}@PYjV8 zl@f>Nz3zx)pL~C&-1OmUPea=57TieMqxnK$LAC@688BzG6XQo{OV6l03*lQ$SSzRK z-+O7+eJU331~jw)whqN9>%-^<<`r@@5+e%uGez25@Hw$2#x#b?zK_j=ZFhgX>MS*s z{PvI5DweIGF}vrd4%X+sWDa?(ZP$bnrKJB7Z`({K4P+(weMn zDBy2G3#%O?=Qz)%MJoG1Zhq*7iqya>gF5cSIU=DhaRcNK=!}HK)dd6l*Jqe_OIZ$& zCfmeTYk|~1w70M{mMtbD7)=o_oq=1I`H&Lu&#LU=9(y3vkWT>#y{)V4@pi!C9ZZ>% zJotbXhH$_(tseLRydfa&ZvkuEeg*B0gJ!8UGp~1ajG=g5tD}B&(DK9+_P$(A z-GWI{U+VI*y$1Nx{V@0hefcVr9RB+{ zZV4L7X4V&5#Ay2Qo@h4a6s`_Okj$N25Dy+H3A?`F5)U3;bW(+nW$d%Y|IUb6>5g_R z6iZHG9b{>Ngz5$~@dxLdOU+6?Z4Cl!?^ekhiKxZpK+z#OXE*&o(Um`=P52P%UF9M$ zIXtE)OphIs>G!)ZrYP*mqs=@Jc7I+)mc9a8GKcDv%L;Yw8p7yDLp8~AS5Ng++G_(- zc;tXO8_gE%@}TwqH37RUI`5j9$(rB}9;S3LCa(_=J6dGTJT%3^e=u`q%nELVh1=`M zW_Z9d?Xd6<-P~--P@vBwi@zN`uN8vZM*zeXITd-);MZA=d~5-7xGC-wsjLM~5hr@a zRYd`}(Aft%(;X=aQffssF*=yO{#)RnhhHNz_D*(!Dj6dFZ`oNXznIBFcq z=5Fe7iH~uyR98ES66yV_shq9cOJ?1f@b==6$JBOKRP{(#inbSA zT_X3Kj7_D{d6kt8?(+ixpib_jbvp$RH2eOI$Za!m)k8%irstIP@XVdtbbNK%h__+i zr)p)88%w|;En{ioo@b8T@Hl-JR5#2U@uP%2d+i3T8b?+MwS>LX&1u;*8x8C%?w5p= z?Aq20PO*L+EgX8|9=}97L5eVag7d}p4hh*t^Aspv8UR$U?6Rb8DpRGcu zc=|9{14Sc>P!QAOl4a}P>;Rt3TNVm!2P#ET`=q;pa*i6rrWZYP8{hls!X>v|g~92> z3O%njrG74e&>6Cql_QN?wuT(s!R)e_j>0(Y_4x*v@_3k$Y~>x{Hm<_T&7M+$twTGWOcL<{UK7#olAnG!Sr2{8@w)Ke%IfCP)KMX7*5tx8NS6{yJ zKvI8b;Uxo7d1RCN;p>aKMy%+me)_ozq;9m|PiyI_5NmknSR6>I0b7bp$8tAh&JOUE zYxC9JG77El@#~SW=y%RJ^SnNYkhW1KkjfD0S+a4797yTo7*;yt zxg!xn;#hAHZBEhhm1l#$x8HPP(8&0y}hINS~uE8YtAkyuaHES3VF@~;WO zV-|YE!+(M><wEumtz)rFlCajprDP3^J;j;*R+%DyBIi0{nwxx&CA3X{-s1e8aiCJRC|?7 zzYKOX^!7 z2-1YetGyV=K1Dbe`ss!>NZFCl4uwt&7}~0LrG`rOOANi^Yd%9pwx&X_&$E(GTRovP z_y^FKuUjI|rA-yz@O>DIdTuzD-K`dNG3FYqV}*^zGa*oIa_+GmV16G0Qdyb0Ji{~+tS5@Qxs53`)+nDtWQ zHIsTZdA3ll8B<0D@eIcmOcBdx*F4rVo_afLp=Ye)@8+~m*h|jfeq-BTizm{#x{cA- zb(;8e;rzG@SQB*^h&3vfm>1l>GRbR~&+9%;nU!2MGqq6QnWLHEFbU3J?%t!Mxmd^^ z=rKU+6NOOb%6VQ3K(NX-?Q@73ZToD!DwyvlESCo>{!oC>m%u$Ij0mq08`onti$QN2 zp&iE55OuQ&#gl>p1;<6g)oy+VJc`d+b-s>waXDT!LUnq0F6~kzjj3xoFq+9wQ)v@= zl?A`7*qa{a)Zb)1LdacjImiu*IM_b=>I=@;|N z6um@KUhs-+$Oy5D6S5$e&uW!!jvG1Q2KvIS53j|$d?zzzbxaLCkak>Il*bz8GNF~d zZ~#`9?$1x>f9BDfaU}MxMgu8^>HYFB)NgJnHWqCaZx_a$d6_J|Vo9tHABPR7`Lt$} z4g@i&Cg`D01SEcINFzSVArw!qB}Sa3K_PxR zAY$GZ;4T#1PGsfY2|hpKc=kHgsWzp&cz?4P{dhAwLCg{<*R)eeYBo&Zi)2)F3Pd8q z1}c_7DTAJ({-Af_-1n(>Aci!Uq>HKRrPu=!(IzfL52}lk;`bGZ%z4h_&G`4Z<)zfJ_(!$kI(vbEDBye@gJEWF*XFF@TJ#) z@Nv#{@Dz6Jm#%40LC-uMyX~xb1Mt`njPu}oKiMmGL*VYHzs8mK=ouXfr6{rQPoOGKto%pPVuP@CBuT1gu`28A*B&^#Sk!X~h zX=b_rK9eaoFCVeGOG;Gg_oguKDCnrSd!bK-AEC8a8ORa4H>h5PXa6{UIY$b}M=cyEIrgBU3Ha83*~Bu82uw|aA(W3G7&W%vZid|G|ONWFJK zPm1Lxa9c((X95zGjLj?8RVrB7hIw2L6^7wOpqIUox9mk+c=46EPx8 zvwx;@m}=goy|yxj0PY$&9}Ly#Y2%7HAILML+hr%CZGq|*=B`!I90w8cAF9EzXfpB` zsIfblHCnFi1&86%^z6q8yK@EE)P?u(gzT}z%2H3YxdF!3k zFB8k3=T6}Hb6N6dQU`D5nY#%A#*TQ^Em6*0OZ`4s3u-e4Nxr8Yu&JI0j0jT0YBHxD+R@B)0l!P5jO)y!! zjfqtGyoovl8IJXNifM2oF|wBTw(9jtDM-kXUcfAfkq}r2P@^`ceu&;$&?P|@-ef#^tx({WA4ma7kyr-GqFrZeexvU`J8A9 z3>UaW#6F5g|q`oN7u z%gMQm_QgW+$h0TTg=3a|NKa$vF}?&*)`inW6$AG{Ho<;;1kUJZYM||+sYex4i%RNV z%LW|OJYV#|j-&rmI^0-ie0HCt7XU=GQMRm#dvOD3EuBo_y6)xKeZM*cm@70 zH5D8gwE54s<-YMQ^<%DinP zCY>8?pVb>GI~l+8WWUYihmV1EP2#oE)?`e{K@O})kt z(1wU`0lc*x*Dm2hOAN;$xq*U9jO3jOMo^5LSU-K01D3O9QZ7U5s0h;mW>lhNf zPqjb0aAe(6ILFLkN_D!DSoIv!Mm(Z7$&O~tMd*i6OVH2OIj@@9dm)(3b2&C#Bc*Wt zqmGe@i&7D>P=QDq_fuP&K){e0M*5{vkP!fKO|;8j2K; zZ%vSNH8ksX`Jh`f-lk2$9YGPJT1?{I<5kp%VGYPqnuq4?&=kfJSgM4+C=|68f^hBQ z`p7RVHU(&jk{K3++v7;+)p(mUz-=rQ+KLY44SUt@<-R2lVn6L%f!|Ij%mN!~qSP~jKY?g(36L-h^}4;xl39X-yF?C)fDZS9poS>C;~7#OTd z`YvK3PoBT0K9pF7SXq{5;*$tO>wsL^R~X(`;xZBA%kwlyojq8fUlh-cS~3raZS&&r zZS$?yCxy#X$XP4yd|$&$Mx4}*b%STe{x5mTEH@*W%x>;W@O5IdPOY(hem zoc4A9Rr)UuG)(NfM+Bs-x1TU}gsid*)%{slLuTqO_=fA5mF$5k>* z1X}g3=_dip^NKq0mY7Jl(Eq}sgX?fHGnOdsXRb(s3om+g6pXZ_vp`dnnrCWz2Zg|? z;X|J>$AjMNo$q*!l)A1}60av7jo*n4iih~qfBA4)XCGA94Pp;khH99aEGO*iYiPk=%k!Hzsv1yH5*N@d?I$VI2Er|!u5%= zDstrC8f=k?Y>H(PYO+5%<0McCO zku7CqLgE43g=V!w-%V0!uh0WM8JOI&^~ZfVu*3iITkz7pM(z!`c_lA%s-E2!Q$?YY z6w-vhIBI3w<$>g)rJ>Mt!4Zs8g%GF1Rd1Guu%L>*aUUrrx^Pl%n#m634$tm0-Po+GPnI$O(8tfYKp zp9T^8Oj6yRYdF_W!aK_xJ}tE`Kel!A0qSZon^^$`vF)rgVoT&r^5`t~>BiF({;N2< z2T@(xIWa1U)Jy~?epeb5_dps?%_U~src$FQeL*Z3gF}s-4i2uqDC`kR@0gvOV9AB- zPI9tG5yKtaGnjbynb$kW#ZIlCFy3pNo@y5Niv@u4xf%Nl7GvPAaKHfA&?v3zKQmFp8Y;tB zmCRuoypoU}dIxAxRFy);P%8{Sp;OGE*;bRa=43M-uFs?Ms*MpUU|E5?ew2>aAKt`9 zFE%09bsB_!lk?D)LM#(ow&v3;-?obRG?J3Mxv;Huw4$+kr2Q`KYj51vfTZe89?$0@ zwY%+aDdpxG_d`2yNAWqU>|r6DYWGO~yEzDi;9LFIE~79Hj=!pqzuocBI!4uAh-8Uv z7S^^+QEjk1XH8HBtMd~=5*!Ik?1cq8jZp)s+hiV=w*Q41j!iM$z*-%rQFgH~+945!115SOsH|#B3$0m|p z{_jYQN9s?#4erpoH;R)8gw0M4& zL^(I`ssg$;iUE#1YBik2Y^ z%H50R5M{P<5Y@jxbmJGmFbgSlkdl*;MT`hWQ+qB7#>ZDnVXHxf>=VH7ZLXR*UftoS zo3mnH86}STy?pQl7O$Dd>N5Q?YH0$jX?^BbQXcTeenx#QT!WTGtOJ_;>&td(Hcgg3 z;?8>0w-F`%2O95df@>Itm?X#K$PnK+a^8fGQz8orJ|V0RH*@0hT~g%#pct~hCAOsQ zhe+Ylt@EZC3p!-}?o?3M+RaaCQ?~wlV_zmtL#eWV2WAJSnRC+E%R_4p>Ax z^mSQtK6l68fl+>Bz?AWzrH+O43FzG+)~bV0Yf^5D>7xl2qi z0+xS&Iw>&XFBUgc&dvnmGA42Zqe*gLOldC{Ay@Ax7lKjaYb;ak;{~*01<&7FoW^C9 zezD!f0x><~k%wj!xQs|&c8{$6M@5VyaA~^cWlMZ{)(lcpX{wL$F*=~dIIz-C)+P~R z;C%98>F^#Zn%Pi&}+t*iL^X@$JbkkI7v(%R;z!Xw}*{mE4($$ zbx{l$>KKV|S;J5E4f%yyAu_wuQ%N6)m`U2!{3~Baa8#mid9v_ftFdB>;YmQJ3D#YX zY>V6Z1oD+C^M1y5ffMJm1yU<71(B^?PTVY(hp^F|Ib|Ys@(Bz{e6iQTYzjplr~-I6 z>BZ6U0DwW&h>KAI$jC{TQs3WI>QXe)_G;WTVEGgTOSf9tKdt-|jYX-l0++&&^Cd0z zkkjt3Q=Kpr5)n1i6kn-;oPJJLzYYYtFvTTTX;m;T zb*PbWoL5$QYOoz*GkRJ?SpFUhO7!ZTq|aEdGRu))3OLYVYzL~ikZ>;r=+F8s$qkuD zOWI<)KnS}MIGw1v<~G<5<(8upvEcF5h7DVWjRe@;tbKKL36Cdc-5Rzk#T#CyKp>d% z+nBNbPfpghvdC@cgZ#F=6nx-$xurU=80Qa$|JVRE=&(APAGV}t=5-1kI&%)Yw@`rG zdF9H-Nn+U)l2*)aig|cxIl!LD*gfroCOMWJYrbFGd~*$^cW^7|Q?Xf0;>p}GTkHX; zRGSQ)=(uPxSdkvkY4b{(Bq-EF==F~MDa&V!I%cd!@?!SJa=K)0L$Qn0*py6`5q50v zH3d4YL4|9TgmP*jc>KMSL3AR#j7Qob%jB@vuxBrf5%2mG8d)jd!i(#v5)vkx>S!tfFm>%WT|l8Rl`D~y}1#; zD792)pZ&v4zBL#KPmYrgLp~R^uPALUxom4o(Ox_OIgjf|gqoZH|aI(rX|E6Z^NfNqM|;j2iQ@PLK4TFOA&Kt!VHQ4aj@iV;?Ua(!VJ z(@A9cBSP1qFX*)pQ_v@=5c7#0Tkoel=i%kQ9yvpc$qKfIrHMf5oPd}S)l2NWqF7ZJ zZT1u*BWn%(+C5_nws15xSSXJT6=x*`nQc)Y${K@M4!fxAyqH#s;M?e+9}G^yIyn4u zU%q*iT0C!`F{Yh4G_vzXNb)?f%w6!#rERrO1n4^ix`dK~9^mNt8o8PZMWI=9w3SeG zhd5x15*_h#K9WYwGCM>5tJ~uNc7)|yuGkZs!HA7e{6Q=cc{Pe~T!AXf({ z)o!hy%@r6yicQA~Sq@SMW1I9M?z}HjpXfg(NVx%8dX$pCm2P6G$%8!tr~lDf^A&TG z2v{5q&Ewpw`oJ=@1lD@?Oh0ojCv8OOZp4TPljH1txcSmxXM#G_&CaBd%#l3)mFr=9$ z_{+SvsMG$}EPMP$2Kqc90YCQoXeer6nRDxoWtYXYncm6cYcG2I=$&R&I^=XR;uI+c z>0!mQ4NikEz7vRxZo}P52=;08537wj4igKYp=Tp=YI`I|RTXm`R*rt4wrX@-``O6_ z&EeiJUrkJ#mpkv(W+Km#pO58reKpcBUPDdxxso(GC6?9NT*ofW$TmMVk=qjOFS14H zX+22V9(DAiuhS$kl4@772jSz3-_wx7Bak)a((``xbaZ2OcowZwOtAF`iT9i;ltuBv z(^<{NkzMRLL$pj3T*>mO_jUQAs9fYH@IECQt+QRTPGohVJ;QIC*F;)r35BX>&G=%+ zpn3Hq5A8|ZGG7E;*47&mIZtJ_Z{4IqB-G=#Yat9wSAR%AxMBd=yU?$k*abV9J5S2qgDB5_K z%{(Dw4;&tIu$k+QW(HDo^(vZc$`+82pb;o0ko>bVFgY=h{d{MQS&}{2_e&iX&Ems- z1;z3JiDzu^5&E-Yn83b}g3dvekiBF4J*!IJcY~e)+iGXN0w?joCDl@>K&;H4rO)x+ zPE&%;aK(B5Mn^ztpG?Y;#T;v_w|H8ltp z7EmRh=xUoU{Z#%43ZUlaDt?PX#Sf~+K*Aw*Yd&Y;4#h$CRNL)oY1x?{F%X}GoefvF ziK_4hx75gNDyi{DUGB60`w(TjZ{9{0YPq0(fMp2kqfiLW3um!aP|5;#-U!$8H=`Y4 z9q{QY^M$2Z@nR02axcQ2i+VAtd9f~ssVJv*zX8~bwLA1ELtlXlVjh&0^OD{W`f`!G z{PVx2oyj?-F1%gI4+>k-7ne3Xj8h-a9#tHevhW}JtPke6PR8d96O!C9judUuO+oBwoid-?vR)^2hr zJ|BB5)-Sja#k0;Xd7ylzKujKvEm^~_*vc7P94ELdAY3Kql_<^0>@wlqQD9Pi07DMo zJQsfc*&=^TzV7p$ZKTuI3JIEFS*N2f)!u4B}@v| z1ou%3_EU9qbvCrQtH&6clr85>v%*+_V~1f zhKF9LN8s-HV41BVoo~dsCaF>0=wf*r_STaP;6$&u#VEJ*zc%$?#NKcd0(-iD`%o)N zM>W}iY2@`51g;vQ3htQFu+k^sPc{H|C+C&*-q|oDBM#nJx`ksEXVsK<*B25Qa~nBRT1chYYOmzKp_~bHv5=7+#7w$oJxP zyx(j_FbR~d`-3k;GHrI0qi{eUZNH%Z)h0xmW$rYL-y!Tg@==q?8N>mT(aT}r1CwQ? zi9TNB5?oYS%=y70k8&)as4DHn()UzAU`?NSvLtOmIZSzK=Z%bJ`CJQ*WY|CszFJV! zSxA&m>6I)7_)|N;vFuo0H?-H}+S1V5)+4=N&f@p3hM9sKym;S}gqbTFSlJYhFY2C6W( z*A5M=z&is~=HBmui5&lIkAu{_2msi!NyC3`#5v=ITK`VQpqew?oRx^HPmx&5>RUei zbR#*+opE2Ht=i@m;Jiy6hsn^!BpQO6Q3x*l(1(F8y=6Lla&3~zfPt8rt<}XsbNMbz zVwl~3Fy%Zb{O26oHmtV447ptzxOe@%zC?0VRwIJZ9seUi)a4LdUof;8&tQMeZ6qdP zsXbod7gg6zwB0Pu;4jq_MvTcva=U6aYf#kdx>&@Ih`M6)E+C9WKgcOx`>)e{+cJIq zdZ;HzC4MkQd$sgfXO;W`gMJ=KANNMw^hiLWB&lEkB|LZp}p4^1Bd-2b8R`#tpx z9{29qpE06V;iGG;9gc zp^Mk1_2%BEXy`g1d8WZivC8x;n{>viW@i$)Qp}>1HkaNWTu~ z@=7vx|*)ye6Wt9Z4% zh{<=ue4hhP%T%jg88ARX07lw)-6r73N}oi+tVKp^IZE(S94cI%Gu&uj9SCvYOO+QnxD6J@P@3W!v2Z38+w`E7om#dyYu%CcQg`{0eZv#yLs9zC1fBqdxtT`f>9g?I z+`Nh75iZHNMgzHq0`_XS2fOiwQV?0Wuk-(ERtV-+CZqw3>NEwnZBMd7SG5B@G-nh| z%=cF&O^gPHslrqg3RbBjz5W(fjHhR8Tw+ ze8Zmirr`w=G*`_)A^83Q-T)WKCJhnZkTLSUs^kDGReL%=GWy~HobAb%%F&Y>+o|`; zv;|<*;c0yYpOLFPra+KMx#wpqy-$8gtdcV{2C)6nQ}XqJtH_w^3&Hjmc+ro_-lSEQ zCzKC$ZqdjacT$HAZvJXB@f;Ry2r=(7knp&%eN5wuaV_0anYg3FPm2FC>b}Qu{^Slfj3Y?l>_{4A<3Y4bCxU|qw3Q88@ z?pr1t(!%XJ;%#NS>r*U-fwJ~@Km5GaSXn?!e8L#!S4&&xfntdbqG{0Nxo_3yX5Ac7 zCoho+uauT^te%F4M3wkc)BG^gL+^d?laE3Pf(nSvJD&P9MjNDgDNcdgY(ESf5UNa? z4V$QyMas}C5S|uw75d36X_3O6VQ`{% z2UP#mrq}8tC^mPXC`TYs$N0ATXr1H8!s9Q(H)q|XW#K_2;FB&KZiC{KoPb-lGsX&uxjhppzD1$G^i5fO{!vh0KFv(jz z=C6iP0d*6RKMsPkB@M#s_z@=`I?1YRfkLI=OYm|?4*v%{-!xSf9`A)=`)S_Ut zQ@+v`73qcui)lt}3!Ug*BE@3J_ev|a(3iOQ{x|cagZ;+X4HwH#Vm>Fi$~Den#L7L2 zkHcs!&zMz&BD)J11SysOrvyL8hKA$FEUB%TCRr+|i1)B?u)H)BXnjMmbcf2ll*2u) z7<_rJ=nugobAQ(P;)s7Em*8wt87bspnJ!`QQaSD8g68?`T-e-lU@uf>fNX2EX%qbz zT!slM0#{Pqnra_olKsM%&6MlsD+_bku(~*QWNN9p-(Hl)1mw-hW}NV=sK)(Pb`BNW zR>R%Qj_hJ_Ken~pqzE_9QeclSe|)O=!0oIp*H~H=;n;TkrhwKvSp$N)!feKZQ2cBw zQJhSGn5t6chPd{dsi35929#YZLuLI)?3~-v)-9d{ygN2(B^GPLuk;u6j`;nloe#YfeZGWsO#M2gYrU) zuICCZ^}#%!U7I`E7v*QX2~`+VXtPz0IK<+7eIaYViDP7Q&Lb^`!c0%J*pff&2W#i6 zk+yJs-;rhkzULM=oo2j(qYC=aL!DzBSYHIkY#7*Ie|uYKE6jAMey87k25~*mBuUeo2B9l?=WX8E3w8 zG?(=GeAV+Y5L5*OayayD0+)kj!q__(*Y9N1&P45UK4+~+p149!Rz$gDF;ABmChjnQ)-F4${|$J2B-_n%e> z-IK5vsi>ZzzYn%aK2_2`UtSN_W?OY*IYD!P2mi%Fa?f3pS2NlDL14T$JGGw`V(Xx+ z3A&qN*n0ZhXYo!(W)onvr@(kE$@xd?>tH1vBAUR-lK9EaL*j@;W$Ikoz;~#u$xdhW z?`<>1j0^8E7WJ@)%}4%e=#zHZ{X1^4UODPuHfxW2+xpzcNuw5Z3^&hJ-V6}@g*~N=qg+tZ?%z2@uDx>$73c%2xB-d z1uR-;ftkKX-1v&|XFJjqmmoXBWFnZ}3eWZLD=(FiIw7)acw#{xbd zH0ceM57H2S7z<|`R-&zNnem{#$n%_+Pyd-wB4|~)e7Cq6mw?h*CHz3F(oFBxdri~p zWFi+_tF7C%)nEx4Sf`PjhH5WDJfyg<5OrpEtjnUgjdM zlP2FzJd%+rxZ3MLks_mUt5oeV2@|l%;_&16dJ9TI?xnivL-fyRO52KjmPZD%tQX(o zDLm)OINc*X! zz9Uxaae!3+x9atk;jeqttg(YPC7In0x&);VbN4G+ccp9By3!hUf%OpS$Nf=?p-U%T$j@?r9v6P0yZcGo5!|;r^7w+|~-WWu&3t?5lle)p;=u|n|aDZMN z{7s)al=^4+H*EfhKmL5&3QuI53?$XFsh)X~ZD(%8-_gq!?1>%4*ivIzip(mhsqvt+ zCurt6-9U@qD1_qr@XMBisY75k^*P<>y6Yt;;X2swSsv0}%p*^eP1P_v6a~aFt)N26QW%azlbkVBiBr;@9-cHZ zNC+@zjr)V(1~F_HGPh%o8B&$W#dZRn$9cjue%MLnKCc28B`2Avq`7rFN`vq|uV~@{ zC#*WQ(81-EoD>6LufT?LafrUP@pQwpwczaI4B`)D>LMh^R%(q%tK2L~m36|p<^zr- zuS_|VZ<<+#EbF~*?f;TmccWifht!=fdnmjQE@$ZvwlWP+&6{&Tu)Z}32NQ^Wf2{MGr8YT&WGQVurhgmS!jOh}>K|^C4W*z*_ zMZ$O|)jWsqj+1=CzR)r`1=Xx`%0u4%3Df5v>BUDvvDxc%oBS3wq=;Sx0v|1fXdCsA z_t8+-L=6_)^%#thGL<^MavaZ{<~umFe1o0|9COi%$bz_JSc6TLgl0g^MVc?sB|nA{ z?#exWS2SYl%S{Wh=ML5nH3eejyB6tFgq~lS6upw4ikBkWtJF`}AQeqyT-iWBX{bm? zRe#+sf9RmVvfSl8H08@Q6)HQYrLpBptmY!~qlH12eziva; zB)vwqM)^Ta%|CcdIvGBKi?zI$kHwZDUr4$w_r+4~2Iua&4rvA{wlFKC1%32>*~;=3 zC3UVoJ$3z5(4yL^Xu^X^SeNh(#%0ZN{fJcmtSSmX=^C}C34a>F8TZ#Bg1z4Bdy&lvhCF~kKc6S{F3)9yWv7t1dOf&UQk6F^~>)|Z@MUv77{=tnvM z1b?)2Ulg0ZTN0}5M=AC4{iV_Q>tAk+^I+7KsVrk!xU#6k#e6E&Sq%CMjwXA7uz=LP zv`HsPf{sa;7mv0It*ONHSmaX-m_N5-WLHp|wpj6aaW$2r@T`9@tGhq79mWI<6$vJa zl&0$rwP&Y@wzsri4Hj%E3Qs4wskVX&RmCA+_rPb%3}>foE2K?_*xyz!J=>(*@WVGQ zy3BVk>DwZ!6Fysz(T=dwa6xdkKb-urnC0huYa*)C^3 z=L&}YO7O=l*lflCUi*C>2E2U>S5jk-$c zq(=qLe9$v?zrRzx42u9%wb_(A%H)bG#P@M`FtQ%K<>7wyiH~KM_&#Fc^nR7?EAI{& zqZK|9dc0A^Wn>@yMSo~*#^d_mNH-;@=UFR>(v#~ewRs|NLeSTBocp}|mImIdmJLcg z%DHO~@pre+yP91by<@#4JV^;w0g86AT-YOBvWmy#F?ZdWFX#rieeMr~(V}85{v7gR zou45v_hSxf2OF6szi~6ZDbW4fTU7~kux~E_6O7W)mtAc3T#*hlDBG+PFJI7y-k0$0 zV=KqAwS+ch7)o>@sDZWO#5zw}3aN>4N`<=9dmgT_9$r}DNOaKt{k}$RW(9tS0_ECU zKfrC}ab;f+N_-GKLfWVz(g2A65P!+y z5xfpy9M*vaTH;t;xbylpPeJV}lgz)zM@`kP0OgZ^wWaa4abk5lmxygKrS!k4VN1-a zBpinA!^HTA1;a5%!gWNI`Xr0Ug%Aiok~)(aqqbhhz^9lv+iN^zpj`K5(OP%3fW#HOQf-F8yyb zGJK3jsW@r_uLkK`z5uw(!Ubs+*ayo*cEtCO)u-kb!##$BK?tn9J~)*Q=~Fr9E#wf( zTOQPjsJ$h8M{7;A57qA#-EA4SDu@dW`Hzm=&T1Z+cM0KS*sZ{!VQ}9&qGw*gflU<5anq;K}-w)U@INbg|zLB$BeLkI>+daYU?lUv=`(aw!f;?AyRb{Fsod1 z0v*fQJFySqDHQMZs0;g-IITVKkJWrR+Pc#Pf;DYF*$&eas%Ra2JQwH26>gYnWvxz6 zX+09(bp>a(`No2 zm?%Ca)^AJIepD)n3(CB3aC7T@`8o4TMVZCVbS9lD@Zb96*Go*3x$`k zLiAPZN^|@n+B2obCZwnhhXfgkG%y`RSqEAWxT|nng-|ln(X?i68un#cq;^?y`TFY{ zCaD#xQAe9CEC1s2ubafXMMVYFjO_9oS520aL*Y|X-%>GZDJxJdkJX|x|ay#(en{42o*qIH~@+qK>Z`FE^zMv_ireO1%X{phgb zd7sl|Q&yyGVKt8h5%9r4{=*DE?lB%y#C%O%9+C*d8SxS4PlX$ryHf2WWH1{x&YeBX z8&?Ge1x)%=X9I^!-X$n!1k9~THyx9^(5MxgmF&D$vXL4!b;a(AWXSQG*zrlhg6(Zp-mMJhBmga(f5!o;tuD1gSic)mhIHm6-@EwO)DH4MzFF2H4nh{}8R5xD4Inxck zkkvq)*3*(H9*pLRJZnyhov5}~h9t!BJ2Gz(d;g?6Vj6X*`}kT!rd2x-5v_2IX*Kbn z+kLQnw&P<2yEA%OctLWDYn%3aL@oBz-mLf|!EbOd4Y~)f6m7{Nf`R=hKR%v#!mMJe z!eu9Zc5rId#_N}g%lr_OH!YGV*j}E1Tg|Aey|&>(VOeH+Ee0>l@{a+!>{aAogYjqaF7Hyh`!_q@jdAudm5_M$w`OqR)vrG7X|HXpWlYH=+GM%PS;@lJ7v%d}*J<60BW;TVg+vD+Z1&w5`KU*fgsw>qgX4&JA?OV9WrKnsQHa)-awMHz6|VEYPP2Et*h*zk6MBklpx; zY%(+SX{Hg{$%!{N#zGyA8`vUG4!ii>@|?r-NUlN*gX~dbngTe8nSy%n^kv_|oaT)` zufZnKH-G;!Xvz8+vlSp)0(UqI60aOQQv|5I|4JILFA~#>ico*z?>PDj$QlJopy<@U zw6dU?-oMb#6!HOIUWhYKCqhj+znpbc(4eF>p{_b{Xx6~sHWJZZawnt@1ga$(+#>Fdz zDr=2`a`{DbqGUC2&{wY&jK0(@1Z{dEaqw(gNg}9g=ZtYRvmem8;p16FD*BU99GTi$ zqgVQD`J^m0iIuGxdk; zR2k^6uOjTgrT_Op8RyCDVTexFG3s_OOi#7p=!xpwq#T=AhL8(v|7X}iOd`ToA+_B0 z?VR#5JT5^97LB+BxyYydd&F_d1f^%F=JJ?OlYqOQ=howDRtpC1D zCoNjD+Ld)9yQi19S%k_QZc>uQKqz5)f;N5`OI+6^0(+aScIp8jtFcrclF)GwY`x-WkUH_L323&JF3rJI%g>4g7CT6txit!Ws~W?`6*mKXo=gsW7x5lBP%4nBug>Jd(7`E;SJ zbx7RuV;8_}*Ck{q^{D{;?iVNCeT>-x^NneBZ0}Z2s&_QqYF>`!tR&*0eR{2U3B!_vBnKpQDqg#b4Eo(4~GtDAQoKs7j#$WLa-5 zUpqLn6}!{xfCn;>IM>4~Ht~S2mK)maz&!X7MNGq@eFl=2U0%dVEjpyWBCXey53x7C zECLblrTV@Mjs4nRkM8zDxZC!0G!KvahRfkv)42CKmP2eql2&VU*DjArq0v1Hyo|;~+{T$}p$iPQ9>@H}#d#ER*<%Al7RmLV zj0R$xAp)`nV`4M0B2hZ}ld4NRdmcI7!T-*A2NKNd$GTRo0fxx!*TR^R28#(KI zQ^-M{?Pt_l3C8Rb@5>NpYU6=C_)V3`=RK4RlE_qdof^xG60;`JI&0s%VJpMz4f&~j z+FuC)C&L zd{Q-RM9?6}D@l^^0qhb>k-`nhUl5F`LZ;ARdeppM&UoVbYfo~bLFmFO}vRw z5-*@))5PWcq%AW=DRF%`e!<7ED`UFfMj>TiUiJ-YmWPzv-9Zc*g&yd>h8XP7oYIDEsi<2EMqUm{PM%1T1hr0YIs*9NX6NSYd>A zuj4Ex+^44pruYQQyR4zG>MhkXLhlUn2!(`#-7)()9LRBxjB`MrX=(Le;m|mGvvvlw z1M!KkSX`}eBPT0l%k}LFKS!0Km^Dp;v{erGHd;D=^2Kau$gsF%l5i;pB>d>OuD+Ji z?0`8pDDzi+#e#CQPudlTc% zYo{XJX(f(2yhnDhLn4KlF`jtSLW!WYm#vmN>ba#YMIe>CD>g)`cLb9mv{lQsv(a^4 zkS`?&i4ZdH{nt;Kh+8+{$GVP^mA;MIvG1F)%4sTZIY=^h2RipFeqG|m?S9`Y74tzr zYK@&5a5c!_!idsy#Kw;ox*t}4$%{l^;1LXe>FHXTPg=rUyt7}&N7&X%isx9MW@M%; z`}$k|N$17l@xQ|(`Tk#cq?iZD#@UU5kxkPU> zfB*)`um5P2yzF28ot#{J?EL!wJd~U*|Nll!H!~L(pe2A!+RVWnh|H#{DW%IQ?cv~H zZsz0!bOSJG+Ss}S{$2ky2WEga(9QkdZ~!h=4sH&fFPywQES#*o|95Tx1|6U|r^J7l zm^_RCdlxg1jXTf`;Q4=ocv(4FIT(?Jh5xfw&gOQ=oc|A9Q`5%<2w+n&x6=SQBC{z2 z__+Ur&2)1I0eJX0|1Vz?z{$n)1@OO*{~4+|rMKp^CX4OAq;qEx7rb)*%^eHXbmV%F zWQ4d#$br;tZXk2yF@GT20eZ`c#XzY5j;Z3YkNmHVD&n-Y$uJn zM?*x2gklN~mV#!3R}2rWBV~?3k01+Ih&>FT7>ZyN6JD% z^cLd+m0=$vsivUsqb?A42Msj47JN}{fzYb8c=HtQMedYhLwO(%$IP?hB^TMG*BtoIQ02QdU?~${FcT2;+O<=3VJg%ls z8C1Mu^mRHSa>&b*4BSUUmvX#jkM+E7^(hVebUy*$pL7J*Tgw5eGQkPZB6Z?@-9**a zg$;)iVIFtYk6_&;d5-fwNuK2i6aOJC`tPzx$l(DsS`O&%LX;W-uK&a{!@QbWR|vYL)?0!_p*dJ4PI)qI;eXGxqX!dTY% zoPezS=j}%$DjJTZeWxsrVVR$?sbL7^y0I@D4>ZywD-C>2*SrE*6@%1*5^;r@L&uy$ z;z9BMzT92^xcjzo!SY#PJC+H}T^RdY>C-M%e%SyM&{`^9$w@u!9I}5N<*zt_tj-(_ zasDv85E|B7XD$9(pW4Y9drj3O45lQB2YV{{N$c~>XP(%oS>0oJ=J~7qum*v^?is@M zdmvr5acdq$@SJ?3j@N+SOLdB4+H^yl^)pC@c8P(EwOk;3m*jfsISUWRGe>FO8aG9H z2idaw=gg3~vx{T$+X|uHcMooYCBF}$_H{>Pp2%;t|-CvL1ydi(pMH4P8yi=vKC34ZIT=<*>!I3tNK z&f*Q0qRmR{w?xs!^K*UdaG|M#b+8RMuz#ku+fiZ_-}~x&?f2zX;@0YC8=WIzjf|e4 zA1|qSo-nzH3ScmY;Fbzw6ryBEGPiLlJeMJxXw#S3H-8d<$7!o`(l2&XA#{h3wVAYd z?K5x_ar#Op>$uguFv;fL#9Hi(PUcnMv&;2~AAc^|h@NYEpzh>wQZ`xz-aE z;roGQ5J?Q#GN8SHWxtG|y&z_Lq6{2Le6kOSTfa#wymk)=u7<<}?iW5MB|c?U2r}Ft z6Jcj+@4n4h@&e}E zycBPvy!ZCpQhbZw7$F*6EuYkv3n_d!?zj!?5&Cdk1QQIsL68!uw3aioJg73bKeT4R z{ng&TNBk3gpTlIjF2DSy^N%EFHuCM?x+i^sVts?n+`L(HOT{Hq$Ma_iMdPCJ5sHze=KIG?w4ZX0 zcUa*)kCI}KKjx7P)d-0U!RpJiT86KHjpVfVo%>>?e2sICP52OnGfo&V-FYq(`y3W% z6@4s&isMFW!|X~~3FcMB%|eBlVgaiIpyM;oy4loz(mD=0lVkh^ZVZc4m!DInG$&y? z87OPhp-Q{E6T0T5YbjCVhW7>)qOTE9Lj7eVS@Oao`wKhA>J8d#bQN}@ZUJi7V!K~| z_r6|$ae2@n3Vzi`CK zerC?-p!5N3zCq;h7dotT_Y3>%X}9mFJ?pIHi{$y9b-anIZjsYtIz6BYqi>*n@^XO4 z)McY@{3LvMuE(W9vYgJy9LJlT7g2h_u|i$*!Zq>Wl)n3-cFMOqicdcZ?U-_A!|j+Z z0{WN-+i6KE?{UfXej0Pf{;@wRYp5q#Rf9$8DJBcAjpJ(q=cT(z2ry|^EuraIx77aJ z!2R9mh6BW{{a5_1kasBCeju-6X5>ccuy=5eM=`?jwr+`UuK3hIFZO3;dW|2LJU zs}8h6W|MQW1bPDu*a7?;M#yX$w!XlBEo3$wfB^@96Y!rtb!TS~fRF!Qy!wCKt(*b> zTND51MiO8kD9+CJMOsXZUy_T1LrO}DQ;c1bo8#ZBJ!x((X?|%*E@8m`?DB6EMWB;4 z$Ogc{%kf{z5b!@sL%f+4UU9QeaN8duh-9P^^5xuFoKo3b5kEVly>?d(4h0CdHtjDu z$ixZhDUq%p4d{}?kjj^%C?_7F7bacCn5AlEvn>kXIPvw&v+?As)yw;dQ#JLDa+Hi$ z%yS9s&LN8V@G9K4*Q2c81nXy@{LyXQXRt=rUHchZ^X9+1BigcVTPd_327vxV}PN1KpGJ#MFa$-q(!>BTO_1AM5PoE zq#OPN=zG2Qz2ATD_dWmfi#X@(v)5j|&f06%mO)uUiVeyR$LE4@KSD(u&CX5}{|FH%1F1(b4)dT+ORB z>$fipEgT5Gxjm`TV?telwGJ(M>%mDjhaaY@(p8gV$K;==L0PptaWwVOwHyRnNn zt0qPKhE3S*gvT9p$6lRgs8!ycEwOpo5le0tf6h99Qk}l)F3astQ_~HSOM@>^!s_Y? zQCK~#tfu`(8jp97>%^&!WCRH1gpR4%7X-e>WIyxGvtc$7Qc1ptzIaq5m1s67tW7 zFo}D}Nv)u+HyII6n4pvMHm`UAOIk~>;x&W1vkFo!YT$a-(oB-=Vt&h0J{NkiMe^_a z+KueN-`rA2`&;^-1-W+yWj=cvE2w&X@MUWu?NVHT4eH|b5V%rR5f;@9}b{MK7$XQpdn zsRF7zk*?@$>%{f0_e05n)Ak3EK}PwMn`WMta6ICXvAETo>qMN{e%}?Ns6&Nx4_0s& zTNFt{LmMu2G>9NxK;U8huKs$IDmOL`(aa3yyN~1%GF8*_*$)`?#~fBlOd}pTDrrwW zap<5@kWu{s>%E>u*uviC-Kfi0+_a|hvw>|_QonP{3f;iNib4^E$Co8`a3ew~B+b#^ z0Cqb>MRyuxtvy4m$Y8eWzpOALRsy-of4KB(MRt*E>QLSdhgQldQ`=+#9nem<PzE|d#(w_+Mvs8`3UZh8&EYiMk3 zcMgTRmi(fI5AHBbkMLx?!sGEZ`s~*JD&aM8m(!h(;bc8M0|Q6AhP`3_-X>B0`TV;r zF>Vgsp|@_zPmkZleFq?eTZOw&Z=D99;e#(3E!bF+)od8<;I$O8PGZY2L=dXr z8pXz4QL;ZoCpa+``u~#AN zW6#j@rn2xcfsx1+{Us@z<$_?QP`ah{%&T=>PPW2aBEyeo2x1qBc5kA(;A^Oq{o{Id zK7!h0m)EZsN?KY}`>yuPh6@l`#`cJX>f#+huC;%q7`lxceP}XK-Cbm9e?@+LftlTx zQ;qNye_p@I6VL0#o|3~@?=)atI?K=8>1>{HxLx5k(b>Ya;nj8XI6XLKd)4>kE#FOI z&0R{#_SM^!1d12|mW>QJM_3Lnd^a2kNbif^!*Cv(RV*O%RsK2msr=TEqbUA|F8ADd z+;7Pa}UY;1(SQN4R#l(pNa_hD7H`Lf{evKf;GHUVozmHA)BXp2J*j5NPsxPP zy{58m52n*L(VQNP8Zc3t(0|t!jTPNx9|;@V`n)KxTM!1(WdWDS)*lC$hS#Hz2RMoZ(=hU$t?$~Pd|y>GeGR$ zcgou2C5<30Q+K_wBM&DTvURNu4td#Ni<+<-`u-rMF{Zh-uU%b*vmoe3pmVGsGrx3- z?!v((DkORxzAeM&<2zm7DVVbOMXc5XR-c*A)UqZ`OrNGOO;DXpEm7-W+-McI98bd#1MmouQJH@7j_a1`0nj2BXxg5b6Z?wFl2u0K>*!Rkp@l{GD~TUB zqr64t7$fH&sIkAu{OMMC{9|^yg^lQ?;MiaS?TNgmB{woJOz@PDqe^5-%}}kPOZ&Lr zchyOMkP}arS1p@H>CL@y^15Q+-J{jam0*Hidg(QcmZ-L8X+OLAq7bXib^Un0gYi$5 zcmh2nuWc%Jyvt*sq15GNvNv*>T0hi{zSS^Wy|9;-oG_d8goyv-+BYw)OuGls5a;mM zOu>DqS*(!tMx+CU`|QnSl-`JDyR(8ZIQe~#C=S;n%mW7;!l;jFdj7&w&knykfBsnN zA#(zF?EOTf08N|ilQ_r6PKQ4~tlDLv9b%_pnnd#aIACF~pL%jw3>>j6d~*niX>ru! zY6qoD1!{QV+tYesZ`iiz?Il*uHoK?{Z1@7jNRP*YS-6_bt@#6aAey?_+7;K zwHIJ+6OmQZJ{7O-8^k*`X;wseIiwue{^V$(+%bzaBV)Z)`(cYpvLR?-(wMQBnoWI| z7u}+~Gqx8s*LP5?l1{Hij1&OkAb~Hw! zAUqcX3P=+Rgt(n6M27<$;Ns(Ahw*T6LwMm(c3xgSUOjwpAxCfp2poC=AZBZ82d<|B zfn8)LdSGS&`9;O~&_9!LJ{=zrw{tW>I-cX;&;#xRGQd6X1`2_K2vm^9P7obVE>3nn zJ{~B93(CjN!Nto7;ezq8b8_-=L%2Ah>`*8VA2?Ul*~kfG50JO8wF1Nh1%WeW0Wo7I z3p-mt6;M}^Is0WYcXG1l2LKlr7j_GjF}t0k8DL`PVry-OFhK##U@G(vn)yJsev|xH z$^~d@X+yZU*}3^(d=MTUPIed^$^)@=wzmG0UFey}{sSzW7vzBp`ghnfasFRnf8~qk z+WsGChH39q*r(^1p>Wvzh;Qnz{M-*x`I!f5!{^&-`+6bFuSqLb?7%GYs}0 z@p8dA*!ej4{*IUPKkEq2%fSxi<%9hVFXw-z8O{Y`hjYOGZX2BcSw}E#UQkw?e@FYD zRRn{>*txm>jahO2XBELX&d|d7{*L$0UB$mQ4JZ%qg>U|=D{%g2H-f_9>@X{>?3x<_J40}G4TVBrXL>mw=YfE< z{2GTtK#;R*Ff;(lj&{bXNH8RUK~zEt0;nNfogjbuJ^XC$Z$J38{o(;_;J@8|g{aGg z4su+r-__WQxj(ke`RHL#OEH1AsBXEqcq6UN6t^Wek(>4S zK&s&4t(~$RfjpNDsOFG{-nFYP?rBLQ)z270^~duhBuI##3EGI?DUDSN%E&4`y7gm} zsJPM~A*VY_N%ndGFMa*UC-+OUE3;Lrj5xgOKatT9C^LuY?}zz0lkxK#u7atl)0aKb zOzsx#W?=f9j0ldvYml}t)h&u^^~y~rZ3P)xAkN391>M7Av;_sxvd9Nxy1VseP- zKHst=Pf)hUryQtaniY(j-Mh2ZA=w}%OG@`<(lbWX&+rDnqW?>sA0vGHbV)1xSW_)|?ONG~;73 z??>}nl?4vJm(q&9InJIYvsGC4*-(koE7rqYiwfO8eC)lNo@(x)qQP}Qq-o+`suHI6_X@KFueRC6YvZ(!Y~6FD6v___xVhnc z-N-^Mur^`8$~;)KiH|5^N=?g*i;`)0oZY8n_4!ZU#UOmClRJV>qP(Ij(eV_nDMcP- zY$#IOFTtWe32tQ8Q3AZ|OwBQGjrYG_;_Vuc>%Eg>mQDAZ&hjy&s5b;6ud6gt&2KBU>yxPY#+i(! zw8X!qByi3@yyV~JBkF&Rpl~feFO<-9P#8pTX{e zy8k*=frH5r9~_LnJRE%N+%PUUh=7lsiw8^vUwPr+0h!_Df`BSv=jH|z$X{CF=Hy}Lfx)={cdYzPE4E-U?O#NHZdm_U za({~+3TNlz;)FqnjmofOM>w4fVp|$ppO4dh5)+hKVH`V17>b6J`nT2$vn^F z(Qp0!U-OIqDyQK5Gg@Bc6kvSe;`m+Pg+aJ@xPRZAnKtbA4Fn1WHzNOK(b5}1*Ki3dvsfzs$;Y&DNnPZ6avx>SiyQ~6hM|UquhE=9ag`>0-u4d1wpuquG z=isP-!3tqqiz@2&JwPUFr+hEdgFgEaOlFvdeYXNzr@Ugf>Q4~({zt61@Ha7OSKlPP ziPcug%J>`;k#-ex;6d)yNbNV;YOmu`+mYs(VXtC!Q^O+T5@XxbuQ-OA>1)^f@=5Tf zmtMM~{#sk@vQwllc3*fLz9{3nxy5<4yKmpVbNGHZkMTnmtJ?48OL3m5JUC-J03|mO zc(ViVJ36)_N5a5xWu-ofwgw zY-OHmW@wEc{(<#TSMGfUybr80J<9jxx|tQRf-@GVnL=OU^LE?d=R6ntri)lfv(8X_}OQD5cWhYCQds% zuG@K2+q>9VZe+{GhGkio+(5G}yLW%Hbt0N){EEa%W_&`d3Z*qapbV`u>B#X9E#J9C z)?3f?CCXYzz0y3`q`*LFDq6DHs{9d~CK)uP$*JK}h~awYLcT@qY3ZBa`L$4+gO z<3#C?hC`)&qt!isWJl!JduRLT9jUZ0fATl5I^wI^>Egdt=kdk9YhC)_m~i#b#LGlc zkh^D(%~^cXF7AGHlaTQ{h2BT^6MNjRS3A@p4o}HfROFVuS>?JDOT3=vcEx8m&)3*A z1U}y#S#q8lCZ1oE*@@a+Ac&>rI@mYsx; z5eDCoALkNz5W^vCSb{{|gdV2HGX`HywCNSxSHGwqu}g=D2xSV*9@^(?Z8Ofdmj{vp znQH6vUOHZ1HNw8}lLa!b4c1Hy_l$6Ka{f3i;jk4pD$0j>-5ie5=9uIpDuw2KB{1O*wv4%QC1si5(-m9!%b^auy ze?@qwL)YfWGquk#_25)1H}gSo!1|^UvV@C^nCp$+7_+CAm|Brgl`M_`D#8Ad(wXO3wdk0j6YPwr18ya4MXggA*iN)d^|y5W)*yY5rOg&Iz)6 zMw<9}t&I)bdb06xgB37vXA2gX&ffLlmvv?+2#D*9|Fiuk6JP`uoRCh;7m(nWdPvCm zYvNCK&gB8JgRjHI!2#}4e^uhn1^S!I3l;npHprTVsVNdH>YbGVbwKd|>|jaH1ZfHi z{TE6Il>7JKpGh-V82rb(^uJ#fti3rQjL)PAm|6g))_|!a;-X?_?rdv@aCEk@MmReG z@+fNr${eu1_^>mxvqf3~j%Vfp<@ikvC@{dt5%~xS*jU&)qaaYue>{N$+QtY+uny>c z@p17lh}#;8LRp*wWNnRb1niMuJr)!V!UnuTA#6=9COe*)A^_q=+FBz` ze_dS+f^LCyv_M$__SViQz}OBX2QYWDH%Ho@EoNb70$hmD9qDKXfKmjUTpb|h*Q5LQM3KXO*aBlQ~tpzyI*v=Z19|~z>adCAf4d9=|0TPEqoimSc0>l7u z;2t0WNCHxT^m$cR7LWtv0R=!2Py&>J2Y?D#lvM-Nfro$wpb2OJ+MxCj##TsB6(CPW z;N=CWzea!aXKZ0%Y~g6^Yy&vkf^}n*v7O^D;hw`G03*N{Fabb*05iZGumCIpE5I7C z0c-&~z#eb_903&I1ULha02ja&a0A@W@gjd=b-cLy1DlhDwFwdeh4K8uoM60wq%$Z$ z3$TI?YS;P?&8^;{2NVGI5b8sR*D;Xj8w zw?7cw1!ouG0{}z9nO`Ao&OgpM1)RX8kv0fND**K`6kLGXA;AD>?SufV?cBls0wkbi zVgdRB$Ql?L{_sX_=r0RDE3X6Rc6?@>)}RXj#?FpsLBcfsmBonJ_9jFSess;{56RB%WuvFC3X=m#4hL% z`@=ZIF7zYzmvqF=A|N0p3EcZllH>)jx>cJqqoKP@BxOn!@yFflDxGnxK zcY!}#kZQWq#cY0lS8*{3n^zf0G4{WTb zyW;^K{sWT-7+U;j)Gq|Tm6pEZ2xF$Y?0-MDS46~J`E9tLdmj_}{7iY_M9JLYKBJocXCa)cR z#ujCxrunlZz0ye`xz==$ZIVG#W#BF87EJxFZyn5VaX*eK}HIEwg;w=_OB=jHRI zeSK=!c-iL(s{&%793tJ06N9rdGrcdJ;B)%0E~~CCZ#ikYPvpUA8`@VXLE>V=y)NGIiM#O=LYEs2$S;5X z67U3_1g&9>LPvG%^qQ?DPPy|jBjpKoCgDNw+$okcwe3OQWrv{or;wH0mB%-lUcwB? z!>aC55S5~9#!Lu1Erse48xi@A`_d-kNS?xp8=ISYPI!_6NGZ%Q_NUzw8+0K-`!gLP zL0f_R@wwTNrHPjZXV!*99%NscXyMZRK@)T=%`B_Dd8&Q%J}k_q`qGpZwIYOok(|b7 zmzGupCvZ`uV+SW-md1)fmG|-rdf#KF*o0Z7FQ@A##>hP$3Jct;mM0z$hrYbKx*50* zwm#VL^x&E;{>Z=eqs;Q3%ps3ACD5+bw==o7} zwb3v8zAxFz&D&F*Z>H-;p_Al`PDwZi?j94NNlvz59O=@+X{3(cFZTJnCutKTN#rgi$ z`!R*C-9e46?~i?n^GfMc?Ag8-8jSWrDQ`CPM`ozc)tQC9{8mHtbeiQy=Zyk^BG{cn zshKhowYmc7>13qYcLImIZLh2gUEVr##zeVVVO6uq69h=S_YzJT;3l?MrKrdnQ-$|( z_^H3ERY6YY5lqmIWzBzt=JCB=qJFrtog*}$dO|0iP_f%ncEjQ7!jz==X3+<%A8+X8 zrD@Vw*CX@ZiI$}6JE+Xkl{c^ztV^bmc9cGjgA^J9AW!PtuCnG_-4H3c447)AaTkya{iim;RteBwMsUv zr)qAv2ONoqT;$dUg9;L4*(>DE6?0ib3t4ay#7c_uldjhp-ARVMVue>OPY;*|a@Bvl zODz8!Utr(qBcql$ZnQx2q-p&FCg(@#y_=bjs>G{F!inCFAL?@iJpb%9K!M_}PCkgk zX%CN{iMU!9z_uE#^`h93$m3pq=zEfKDmgNrmpq5DZPbq*ArdLQk9(PE(lT`Mm~ZGr zH!)1V^VD-qWGV6ZF*M|rU1yIj6Nc_$RuFi}@pBMHSy$MN6f$vNyTAuqMrjB2jL{pP zd$5G2`SpEO+E>;Uh9kH-(3~Sg^NyxNY3$(E*$n$GQg~OM^-hf&M^z!K`X_ghNf%?ph-(FYD2bG-$k?9g;^WYo! z7I@qqO`^z#jTr_7+6T~3-gtD2LVgYXj>zr^O zt^(RJxQWHQ#e$@&Hxx*oN|f-0-&XNtHlbQh%37xt4#AusOTIl{tKWgbp&WA|xSRDE z$AvLEe&JQ5HgTiiqn{;J>-^YdD9JCSnE~Y=y(-nwRfevXT^Tg2)Lyc79XBhM@TJ728qQr-)5e`0oC}%QNh8s>{Tfe`^chFAXc4pA zM}IrlWR=m5i9dxB>!0t-sy+598IDp?l1!m^R1?ju%XrO?`U@)-{@2lw2@J>^dHwQx zk1t;`oqRZjT|M4tOWt%PSE!G^Bqi~k1Nn>~B@&_>|QWu>;y=%JbwLle+^S*B#X&gOGb0xVa?Y$H3f}euO+j| zTX_SY1k09$te1)p?P+F|hxg|)sE!3`$kdhdAw|~@y>~6d@FcUiRm%}KSC62TEl%^y zS9%5Q@VH)oXs1ayy4yd$8?yGcE(KLhPiBEf$v@>HgrRAm*uWJVQE`hFU{+aI#FwLe zPl7!dS6P<;XeiHL&*}W&==ef8hVH|q1qF&+ocmhO?qE|s4JSX0zZv~CpEKrLrCGuJ zJQZ|XpDTxiaM5t&RVf^r>dXQYYNOawjx)e;xuGjjq2VT*tS{a=`i9qq;p;J8UQ52ODb4A9C(*T{S0P( z?tHp4BI(j!#l3hke2b%t)A!?1^IP+!A3|U&^3HeimJ%~@>P>yWPjb z0ZeS+`Ev@|?II|p+geq-t@TrcDv*2*3EI>qL^X(ntBlh13TR>?e_BE zz3|y*NVdT1hd3I&eIk2Dk)5qdxeDy}^khaYR#xiWW(*&KSdY) zn^ZQ{tdjj#;Hu^CTcw1GWngvG#H)9%O)foL`%+@I$}v$ON9UWnN1u9BBJzQyd9zM8 zxZX?98hI*SK4{S7{`5g|_VZZS$Y|ZLgYl z9J%?n(O(l!5Dr-T<%sqyah%Rh&Z^+M-5C)ibHC-k%(U*Wq)c6@@A7g={4~d~rI+@h zN7vk_4L$+xb5=-IXrf*&u&`;eC%-8qVIhE3)oEwG$?k2{RU)J!JSTsJ;D>Ydn9A~t z5BL2}FrVUA`6;Nn)>M4S^ZvYw%a`(_7AGBXWYJjDX7yqsDj1*5dCSjCP*&iwKP0x~ z2Sb(>Y9)UWDc zV@`K)p?Z9XgnVcO27aXA-CWE^U=gZGiHUZ>OPno1lU*&+S6GH)vT<$@ z=Zz=99~V{My<+6Nq*70Rn|6gb$@JTIPc*KDQ|E_%B*zkOFr0g6!=q0XDiN=&=z0Sd zhtkVNL+=+Vv_hbh0n{`M%-MuXt7akjUJvu<#N{Y4@R_r^7&Hthi^i@=H7X$*5cAA1 zb4^#_;|Q}Brw4D8CYNVPGJiVfiC4Uw5h|;%{uJ&S%%DPqR4G@%CVDYXUPj(!;GXG3 z(pM|af)}+IlPu22aR2gao2`Zk#sRV!Qi`c{Z=MaJWo7<%Nr<`LX z{N<^0%}fG$@?t7q!gUfp*%MNQGF!D348zIF@KwI3&=QB()2F#V@KN8I&pddl2Yq?N z7>4h@b$_PAfpp8$W@`B9<5(fIaxpgnMWSk{e)rS?l=`^(r9=?b{FYc>9pdH_I`Ye`Rbd)vpHT^ z&*1xV9>Ywxk}k64<@$pqaTdltwz4FBR6;|x@XNxvk(ZerImY+g*fLA*-R0h^w0b%# zDlhe#O~r_rUTR~g6Q`Oid;C5;RmXwaOw%t_9ZGe4T(0sy*-wKxRp<6m>^hIq()D|M z64tXd7QuX(4j2q#oNK-*g_f7n23nVMS>dX3X<9Bx!mPdI;*Lg5lg(+a(p>VhmmaDx z_BMBgGu}w9B0XGb)ZF>R@Pj^Es^hJvl?>TzbNkl^f;6uf?rI5Fre2#*)FS3E(4+Hz zYoV!KVu&3X#_zaWuVXiAxt;!*pJ#Q8>s|y}8-*y|RmBtFA!`GiG;PXVi89QgxJtu6 z()dyIfD#q!OyEX;T1kpJWzx7y&}hC=Pr^XC8@`&#^^ed?@#F&Dr1u#Y+k5iTv#z6A zyBq=e-J#!o`&z!4rW(uNtqJTMV{b8DXb^-NFf@lmzssYE6L^<5pwQ2z;{w?iv!YE- zUi@0qO+sS)W|hacw|*nw#vpzze;6Cw)X`9j^E20a_hYeD6}8^09W}U5tn~9k+@1KT zRs?MJdZu^E+w^k3I;W*u(|%c9P9-1kUe$9E(EMI>E0_`RuQ~Gec6OaG?OzTlu9fnH zkI~_YYFgngN?`f$+;mRI%)B88kpi{D{cz)2{(E9?$1%%2 zwwRYJmP&UD1ezD$1`0gNs;EIS#Z?|A-ftxBj%(l7eOp!8k?SwghBUoijJfAm)2A2J5Hs1 zUS$9Kyo*3WjX|X2x?@b*%3udhnDga%5eM4`_}y;bv!6b{l};ZI*y+<(KKsP~u`l$e zM>p|u&ppZFqr{(k`WszE%>*U~jH6Y#?K38#+RsJQ{XN4OR~%OG7UlYeXr@0WsSz0W zdLZ?Z>KIbt0V5&B)f0ME7IQ0>ImJ-rKA|hYWW_Ae+f4)U9CvRqNz>jUx=!FmklC5W znmzpVhlzYT;*I9%b82cXn-i zVa@UJ@{%|v9l>Cs;7vtfF(j9m1NY-r-_5w%&;2sm@8UkW5({yX(W~QSmI_sA??QHEanllUU5R!HHMNqYEg7jf}aHINdpN`c@HBKN84p+*IGH{dA z+Uw0R!OoK|??gQcjtenY!~C8g@@2;bc*Qfxey=xsL9{~&`-;n{3hSrZ36hF6h8F~` z#%VvrQpD;_V@@!5x6&WZl{rcchwj7$_$02E9Is0c$(9Uww2(GscrLsBOs$iAMm@$@ zxMVU-UDg^Ab<=D^dk4iljXsLzO(;v-&ym%5srN>2*oUhJs_0GD$*x8EqhBX>dHRD5 zP?A+Ypz%J#4jtwlhu5u zB4bLnNoeR$WW7?bpo0^>Hyvq|yU^W`ZcoWPa+Np8&$$1VTLl4H*sTsFOxEhlICOfe zLe#S%y#xd~ zlI`EJpj3mKVs~ibO5=aTZA8=IS zRJ6Ts;2o3NA>Wg%MTrO#{w#ZG=W3kD#6v17S7n>4(#>x8aPNZzqOH)Wj;0Z7raXK9 z1LH82VjE22sn&rXCqcrjQ(c$o&w+^hp+;6;6tWcqtNrB$oh@I>-v-oC8g=FDL3QzveuPq%>aAdrxp?^%CtX>&I1+)zrr}Ru5~L zr*eI&&4b0&nG2|KDHId+)0+ru4F?BKbZ?pUA=*%T(}S5Dh|wn}dOZ)y0~hf1t^G!= zy_;{UqjllDBsJV^3LlNd#Ak<;Loi`Z@BBN{U+`oPxzg&ZZFM{ZzIoO8&3p(T8e@{I z(}aD_ioebtw;5+~Pn9a6*cUUplOWMukW8Js@oHzH&lfK>|9MI}^)H^I*E4da;&;|k zNrC7&%Y6&#A9S7$an~ivTgJ8%594>xh!C?{Ks6MDdt zPxfq(DP`o8kTl`>1I7H-@&~eL47(ZGlGETPm#OX_FAy;O+eq3-15DYLYa!?-PcYObmwmrHH9hPk3Vhla z5X3@wYf;>VIwrqiZ@fqM)m!WvtGPr_dPf5{0cQowt3^>SaaUYP$UB@#XIg+Ec7OG) zvhaH^93z`-f*cZEwYNRohH%Jap0o_{rGz4@Y%L$?_#MaKv-u(R-%;a@F*$#n4Af_H zEIt~NjVOM*f)E^<;vSTwX>V>Fhg-m&!lXOrOL4pk)|Q4p){J>|fozNjX=h zafI;*(tpo(H&*5ANstdJ>4(AP;s#7N4b>T~d!AwIhS?;+q|`XKLI=qAv3Cyj!}6b& z_R5kUD{y-y#qWY=xzc&ow3V->JN&pE((OFUcTagsfPz_Y)#3AcHk>)pU6Eu3Mj>(O z^^wu4X2j}lQb>b-4N2jgw=|v&`RJB|-ko5Pc#4E?54|_sdk6XNUR9v0Unu^H-W%|+ zJgG$H_OnPJ-Z=BEN#A41jlQQ*h1AsF%6&GX!h7G(Ilgg0YmocubkorIq)dN07+%7|XLa~QwOOWleUi*Q6|(HtzCQ%}To8z}gXVv4xGe4|q*SO|T?9<8!jqkE| z4!(ARZrwZ~`fxxI-R7*-y5C)~`x<}hlR^GR-Sn@MSOqQ%g|Yny1)+@CC~nq%i)I9= z9VfdW>kKO_#7ifCbM47;>A-;7V+vT|Y3p+lI|L%Ju97vYY^Fytp6&GY!BBq`M_|p^ z)#!rm;flCX?IIjnnimd=uZ;VydVF$eEozPlu6;>O8d`o_)y{n=ZH*P~UL!-xcY?-P zv-`c-pE5jWXsJ1@0Xw7IsJOn(^M?D%W)2-BlQ}7hNQ>)=DXfy{%f7JZl$kv-=Rva+ z>;PM~^ttnr6PfaM0;Gd1qwMs@6gyi8{bZ!cTkKHW{H-g|4ytXRFgNv{@f7p9Bun^S zFA}O}qZtx&vUQNI8`z2)^4@Mq5C(J zc~^0a3>e9}ocgTJ^|*qs;+HR-2oB5-_C`x1U<7vcXV75oRP=WWo0fu1|aDDlW@LZ0ahyiERAjGU3}ZY0mcCEMU9f`o=zL zyyL9EVD^ce?bQZ-`De9J61taKRw;6EYl(Hz<6p<42WutgU`$sA@buUormwo|K+8#I zG`FFq%DUS^H{KQ3SdffPN%S3UkdPNS9m8V2s2Y?Se}VdH=EAWPv|=m@`gU?6WCb>U zCTuUQjIKo9Fs(ZZtV0FFzQH&WTo0@eIoG@r^VbtbZmXvR6LgWUME51lg8r$8a2b?#DLYRu^-6EjZL)5&KCTE zy`ko?ciZJU)3h%Itp{l}svKj1VW-rbJ^wrmIy;Uehqwo+>X!^e(!*`X1aj)lPG1}l zj^Y$6&zzb#;U<#hwWaPSj~9^*G?aQ-|pqQ@81d~ zveoETv$Pni+rsvLK^)HiorR$kYr?%_mt})|TFvU3l7=@vlun58MO$EKFI%wp%r<2Z z)RhDIVChjAag3wtGyG@8>qMwBasd$rWo&4cQ~V*B8^#guN}6-|%1}6AmKj=$Ssfu;jxGu= zKah2MspDH(`wT}28m_zmp-0gn(d%)(0vW!z$DOtOQ}C$ggI11>2bWZ=Ps63C`MkZj zub<`)71W7};rlha#}5b@w?s7w(M{XW*Th*!t_?7hUY~cKAy*JpknF0BlBTv#BkoY8 zD;I+)zx|eyZ1;8znKMH0MuuYz?@j!EeRY*)FY)*U*K6kSK9z_(`)oP-lG&S6Fpo(R zH?^Mp;W_J(Hn||FZ=c>Mcmy``F>LLSwB{47nCuq|=V+&{knbT`S`{@b(#xZDx{~pt ziSjg_SBRKcvnj<>wv01~=}YL}lqf`%l)u~?ct&Vt6h-1jOqCceu0j4J`kE1iv60XX zg=ex!L$&tRUzc9{$@?uRwp%w(&IgBJH;Al9=@%97k*4=$ipVs1J{znR30WpROt~)p z;DhU;#mf^<_bL1*%j`lPcHW}oNvW$YFPYy3arReAZWHYl)gRRx}INL{d=7W?1^t<7Mw8RuiOHAWo*W1>!_$V*Qha{yH-6KUh-%#&)_p*CE zq4t$IetE>Mi09|cE8Q_w+ta49OZ#st9~A`{biJRc_LUD)sPseRALNPDFu*Djl#j$i zjqlm?RWWtFiE?^l`7|3Rj^MsrQH<9TyV9c8ax8^fpGc(|uiCdJZck)EmN{+v8|bAm zQ@X0b_ePX!LnT&Hb{OhK>9p)bLLh{em& zYEoD(eEH~nRK^9)+zgl|(fM_CEIswjbp+N}o6} z8sl>+vehs?BMN=_Iew^?ZI3N&aEL6yfn;jy*28s@8?RD6RmIk{yOt2ZROMhCQaLWF zzAaF^Z3hw6ag`aMp5Tdfam4%2@K8Zg_omoT6b5UWhmG#fYgKOf!bo!-+~bdV4!tDv zJ1kV8x2El{VF<)wVtD_&qT)M}F-i0EYdiyo4Vg#mCxg#shQrbHjcB2Zb};8xbgz@# z*X`N-J|~E|x;>Ea_Ei{Diebpl`<{$L1r=`|V|RD9E2?45Z??wTV|T2tpJEwRRr3Cb zjytn!#JS7DbKTter`ZbqEH2Xijg&_oXO^^F;*H|toW)N?gO9W{(*=%aWxid(iSc0v zT(XOJR;2avGdBZPu7A(iluyNouGBJn7khQ9$qgw{_0DAqmrU4>bUb;bTOL>reA*hf z=)rTBCr_d1N2{~;VEMe?Spu1JI5nHy8x zKwhFMZ5DMfuQmNvMvtPJczXR+r#XG#7PCr|*h&q1d2OupiLQhE=S$jya`KNBugex{ zZCDLf9B>z*VGP=7f1Ey!qxL5c@ZJ&bB#L~Uux6Pv)vH=g*wj?u;(k2+dDTtx$A~61 z_9)ChE!Cpnu=FrrxXF5$hsS)}#YbxapDiv`O6c+SB*)hRydHx*Ya5T|@EeyH3&=`^ z7%`LNs*DbqZWXT39Wsb?Tg$cru&&KfxLC?xwEgg%iqDM zS5Tg&>(Ap?PQN}qIYm23x^!v6R~})XnZVqQef$`$?q-X_-`cFtkFWl7kMDnKvp(zJ z1&`PLqs+9dPPD`mCjuB_y?_SQIU6jGR#lcDC|tDo8Wui{9iv z8m_@}u>ag}eLnD;%wG-H;0Z0T&-t&0Yc4LHKO3&$;N2M~7Y*0{6W%{Nufe|Wi=JyZ z$iZJd*D&zF%pX11P#A;_1|E>+2G0}mLeKu^fq&C-{qOo{FM44S|I%^__VS)LoBnP! zbphP|?9@JQ=K7~j?O#Wr@O8MsPVL{nXGfd<_2=x_|Cc`(>;1;~?>^74{e9LysQeA{ z=d8ba&0&8(4hzehKkIv zyCww#%*_%P59{((h&b!b#Eq~Rk9)Qeqg9k>}>*Y%O*dXrX$NN*az6>cIbNMPW1O6;$GC`8A?8W#1-* zqaQ@`Zj}9)k6_6-$xSwjzg$V%VddCVGQgQkug>1VrUE;Pud9*{?Vj_?{@gqnqtRb+_MK**tF(1KW}*YP_@sy z@64B%4YArBiBz_ORY1V7zQqnUy zD*b8kXHF))B&U_#wCDD1z)RJvq3w&+2UKR{D_!q9jsVqRZ%vy9Befr5I3|5zi zudabkrj3jHfF1ZsfA5$zO&D?7#b;fu$k!+Hh3dY6^)rAt_cfjwuvJB^gFxq|Iq-=2 zilH4x|F)rrdgUDfwvhbV?tOemxt7`6&@_UV>eWn^DqM0e>YFGm zZ)B)T30^j6?l7N_(~0IkdA>9GDuFZUPJ?Uz?omki#DOy6XQ6`#l)h(jSJd!z^e#u; zQ-!jI9shB9vHXK2YFhluYbZ^m_2`k1JtPAukN*{mXJguy`nY+pIem)!rPYr5kwW#S z!%5T4#M?zZQepOZ$F9js{SEA8H?P>Mia#YjROywP*{IhYbxq-KEz7qzEw18&m%7Vr zTIafOnAc1DEQ>c(DW=}Gf-CX~0^n!g;v3r>u=|z)b{GwQxRxa8 zwsTL1?CqM7aFD+3&*R}$PYJ#3`mT!AxBKmGT{~j^d@srl2SP`shHOW_(GV=G2;DJv zZ7s_Az_+V5bo8{C3c%jhzZRd!mQgXtt()Z`&r2#@mnn<-|zcL zz_fbPScHyZ%5gQUWMoj}Bt9K2Z|H#FltQQMb(8Z$Dax@W%r&~nCwMo9RMN9hX=1h` zU1A$>Ah7Z^dOTf~$gTwX;gL$AqLN0p1}=3ssh2aqSU)5FR@oc+ z-i2(eE=i{}PWJdR7keJf;E#eUK*UU)LW}sOUV-K=%;CG$q~F*<3en`o+ZNpv zxro%PrpiSl^=Gr~MN5XYtkt6Z-U7(3C4`07?6YYi0p370K89%&fsQHLRMoy&MSEAV zNt8js72aOp!*e0>&gCm_HtQC@8j+%<&m~gbB^#xZuVGvz>~*8wYr*OB*r836OKeTx zA|;q07(ED6^ITefZ6wr$(C*=4KCwr$%syKLKbO`kJ!&pmVJ z#>B+zhkV!%J2U^thZQ@&wf+dZ=BxZA*UC)m38)u|ljRPZU-VOF4x^}htmHpixTLsU zv+JYfli{hg$nv!AA8NT;Q;=tjd{EZWQ=xOj)f(Xk89ijF&jMz?J!LdyA0su0s#3-$ zPxqhta~PV$t_9tmKR9wSeAIb9XgwMR>=)nS>d1UQbj_js9BzV}8Q#?|lk?5oZ}ha| zG@ee3!g5vTd((|J-Wj;AZFw15?0w(x=tn=G-{epfi*-2U4AD69rJvZy-BBU`C$9aw zeEt7s#r?Bo@E245WyP`m1)YCcacqC*!vBNT{+T=YcUlt^5s{Hq{%gg_O8z%i9MeC8 z2>)iq{qu|e3Tgik-~JQQ{;yWte>vU1v)MnbxWB*jKLL&X??wL$(Ef`Q_gBrMW%>(e zj0}G(4u74z|DMqP=_LIxIqQD|uK(!}{-^23`j18Vdrwf>?Ck$o$$uRG1ucIQMgJcv z+h6tNAEzhytG)b(GsnjC*ZumZDMrBdFB$FMr}`QH*Jb=$tn+X8ijDDKHa8Oi6C)$% z-*x%##`>9<82)x8{_*+8bMSx9dRF~1Rngr^B)tZ4_iF2uc5rtO1LxV?+M;bk-qa21 z(Aaz-0AHsHGg_6P5-`K?kKI8snKn|$a1|YBvDl}MqzYk0F~le?PO|Ts=ozf zQE5(+wXv0*5`?>ts(^DN^Y1m21Cf$qG|!8m9_!cJ96}ufp99JO9tto6U}FQIrl+U> z`w!$)|NJDTiRBSg-dm)gwEXOCZi=4}K#AVZ-dpD%P!mh|y!Ve?xF%PJCgAnX?~qr& z?J_VBAf0M|0O&Yc1cH*HD&j&4(7br1MF0uFtAH7@764OrW$idj0X!41CU?LEAR3%3 zz?PpDfHcn4%%E?|>5wz}lyK-ikllR<7T~WfutyePuI~dQ01lw+D*-w>zg$29bpPVU zi0+FWyf!WXfoHQ8yW<~(SL;@XS9C&g^RQk-H$NZ0{v=!-9o?xc!I&EVUd`lT(x2$k z%H)U({&rmfzbydp$lmy4I5WGSq(}N4{j^>^b>z5i=swibvv+wqWr9AO!+i_u{U`Pp zeFky!xn7I5cK=J-pF}|5K1>VCeH%My7sof~2lS8J>reB)L;Z!G$l~JKwSHG_uj-3G z#{f>Qfa_Wegmn#H)0W5Y?5(6@cmZ#@it+WW4ghrxpP5^m(|7#d*8(Sgtl`JG>G@yM z14Enr+sn`fa7_XRYAz06nMeW;KP60mezL}XfRTP;AwKzuZhmsxepCy84iJ8Ra!!7r zXwS^7D=mz`KUc{5{5BZ@Jo@-kqrQGnZH>Sip5AZvf2@npZg(WUTN#*Y$o#YkjqKml z;n2uZ{FnoENCa~PoK52@(^2~dhMw(nzfD)_*ul9r0xtvno<7y70i&vDXnuxE?Le6t z>wik`vVM+%)-!+9ul-2h(VfjST_r_Tao>MF_Z znO^A`keTS2VCp!=kd;o#h{h$X30wj zz>JuM``F(xTgH4}nV-7jCZ$inY0K;l$Gp$gv2?EJ?8(}L+vyhhDteCfpiI8)yy=Yn zGFw=WM&92R&C+&#C6_~Bowshkw8J{E*ZoF$O(FeFns!2G@RIxp?2dyY_0p3THgQVj5!1fH`KE6*<0AeYHei zcc%B#Ws`bF*pohrnUvG0gp}sSv%ge?A-<|FOLmwLM5e(KNNBhi3=&?H(yL#bc?cf` z=2l%!3^FL?eAKIcR58I|Oh5<|a~0M8t7;=*`x9xpzv44x4{;B{%Ekn9S;;wLM$948 zYdBe_)a;ilP>x-aQO$Xjq?Ga_<^qXJ1BQrp9!IX1ARgh<`0=q-ANWtrP7Fm) zQY65a{CyTg97PHnI3AP&IZ`uS3z_hv{N8tLh?d*gb+F^+XE(HLy>ke}6a>2qPWU8S zW7Sz7HK~T{JHF2wrk@1YEo7lsf~SX>hzB+VWPGE|K=I;p-g^hx9w_6zvuqw;o^UH6 zhK%F@yw{6c(Kc(Zh&Zb#g9r~O;)$#3)V>l&*uFR(d_3Na|MJQB#sP}0qT17-_%Npz z`Log4lXcVbZR4;m(p6sY;NQ3J1~yktzNIuQ^*h|lb+m5tE=++9-La?DPAT!vDNV@{ zooK%#I5fcWAJ}@CkBwyo%nkT( zv8LI6*W#OT^VNvVbLpXzq3;J=t*P(uD0MBDen7jdlBeV4I|+-lssOQ@GMS@x2<<6A zVM|Ck;>?}Eo$ippgH(D{Ma;Smhs?)u(tMcGRROE-dX&1+Hy5R$;VJ{R*B6?coj1p4 z#eXb(jeS{S5fp2_fQP&%@mXgyFPRDU+5{Ok>&E)%8+g3P#uauf*3@QSu~5l-xsjEGIvIoIg9lC*%}Gxjk|rJb*EW%S*iPC%Lp`T& z1sWBjq?7WHPQ3&x!9fh?RwEBxDNk6u)+9`e#4}l-0U-;(Rn~m_ESH<=ntw zj)mdLg*$Bv6S*ccT39I5Uz+)%wf<&$RIRZ51sO}*_lI#VjuZk?*pMv$r~iCX1iHI( zIP6+SV8!vGtcX_q2Yk`0O}IfS2nMC_568taRr@Bnpmpj;{Dg?cPMXNm$FI-J^DOp` ze6n`44JthMXB%}+X-u(2|HDLOUC-#0P4SX8l5rQPO^vK(1M#OL!)@s$d2ZQQF*Wm_ zGTlY0t5S=0V7RvVfKgIO-sS7Y*#sM|50soBa1C6wNDK;vC;@pORDmk!N_keOlVIAs z?qHbrWv*wFF2LeNnUv~QOg}HRG@Ppge

x8Ca|aV=g9$6yt2# z<9CZnYFD~oxQ>$(gdL9hnDHCgztDsdAv$^?mq7jsCk^{m*`70UmIcy%VvW{KeUY`m18)P{UWdGh}WJ?dY#7?3}?`R z?*zrS4Y(u!O%~`NSxKUpTXZ#XV3X4>)*D|mnc#g&kv=Hz1UCi{t}Ptlu406$W@>~( zP&Ek@2rO&r_HD>fTbm4XdF{n_9c}`me1k+7nIAl|DBM!ojMO*S)>T|5NqeV6XFd*y z+n*lE18iZs&%~$Qu)eYOX>+G-{G@1&-`XwlOE%`Sa4MF3l8$G5qc}J!x`--EhIlx! z^f@m?Ve*c$ArmXZ1t&DQ_&j&ZmRAGEmy6DAcTV1Onbjb$A5D_Xj?MTF$e=MPtQwWzC^NM(;O=w! z0IPq6I_I&X-&yblS7sQNhP{%D<(xSpx$L`)r-&SCQz@nRJ{|h<_2j^5VmFt@)d{)#b=D(k%u-X{B8aV!nha;Xj5rJc}d3J{Z1FW(*F-U%T5l!$tS_^Xm> z#Dne(UpPQXXYfzss+lA6?_zg-4T^aU7@dm?9SbLwP+0})DOET{al}y}is`u4={xuh z>GH2bAjEJPlByJbHN6ZTJ0sF&>*3TJEc31)CxLdqCh5@_@|`%JN@)JLF}m-aKK0Tf zZz)j+&Ess=KY#D$-qUkiK$tnoQ7AeuT>8brV&PyLFz%OmlJtiqi?(Vs0hxLnhEG7c z(_xoTftEy21PfRXVVI&he^(u9W5Qa@N01s9CC340WIRiyaL29p-rpc$oX?TUc9t2CJEXKlpH*02#B`~~0ClTf*j{--BHF9I467cN#32?mLJl>( zdzg={bcz?Vf*hR|Ui{M8$d7(3a-fQ@k35y-B9Bb8CxiSQ+{x_D-<;7_j5csBWX!d# zc$}{JF%=nlF50z+v(W@YBYaBiM!}33_#82Ag9bq-gSHdd*jC)L?*ZFl(g{02K}G`o z>m=_x-5QDE`d6UF%8b9a2s|C{TfjSKq_a>bLIAu>2TG~PHHpK4z=8eq3Vfe#*y_<1AJUx6XDL7 zK4|!L&EoRp7s?x=QSHdR?c4=KNdZ_oCo6tT^l}fUlaS8m-r-nr_a83t}@9 z)LBM|d-04o;QbCrK`EPA8`g~{S4F@=m6*rh8Qo8M-~D}q0LI@-zNj0M^J_|-=5 zGt|GWl7P2DHn@k?35*sRN`nm%Q|B*7Yvke{$q`PdKBRso=Nea4fI?5h^k+`CevxpB zqhX9CVFjIbhs9uQE|<0(FI4E2&R;QrAHPw+>~#I5Se~m8+ryVb1FuKq-%rhbh<*{~ zp~tDJNg(`%!K$e1Q;2~)y0}K~n3b?*G#ly<6ZwA#oIgqm%8-r#K6&ss0LpY!x*Rqb zd2kFq4vmL4udeFYw(<<2(*GK+LnHpwNDO37WK;aDf4HVVP4k@em)rBACj@bp6E90*I& zpxm!nUxj`(kam1y+FM^WyDWGSzqwL}EIJD=O?W=d+@+M!Z!sfD?i!GrUCK}@qx(Kn z=oEzkHT;zDL48hnN4=d)K3@lL1U&@%=ZrK7ZRAh16ax4$qSqQsEU#FP6?N>$+_UG3 z69wibN>-&YEiQ?Rrjdf;Z&k!heJ|ivVWB|4Z^b(pKyv`ApqYbVpT|&<{;u%c`E#ge zG((KYD__lq(dZ@LS z%Hitda$81bwlAls3Z#)fI)NItWL_y&aA0^CGz;#HTxv8`^=MV!r}2s&_Vx8>e`Wff;=~^PX&uFtTh9*O|eeT3xVfKSS5@w?h)H0 z5Kd3_4bPv4%Xo%+oE4dB<1$8gI;9kp9{+vMyf00UY#n3o1TkX|IW{18S;46kPpSKR zc&IbPKV0__47!j{3U6JyXocNx;pDl8%2}Bl4H||Ng94!6(WIqO1aCSE@{L5A^guB8 z+7*Ni8q9KF8Uk_5s*p}`Bcigg0dyyvn@F6&i<`PLX0CS58TGO z2EVx^A+40BL_(32Q7ad`+Kg$)^fetRDpMn~H&lLi%YHX+%Aop-R{R!Uc*Inf?NU97 zCLVklZtN>j-y8Ah$gGJ&AMQmn>#KIWmvJwanM8a6fkvya2|3@Wy#MR1Dl8VA-GJ>x z?k#M~Ms2TsIVZ9PIN?%G7-g`bED@@%3Au{l--~WAtKnGAkxG~0G@LQ~sQzZy-0N{% zhjFBD4Zfm<7VkqyJhk9hQV+vhblGc&Acl+~jdZ91$2p3jaX2HZQR4HdXP579eoT@} z)e1ClgjsR0iomrB*F-M2QmsW(TTZuR`Q}Ur<#O4cP6$unL0j8Rg_vxjXVO5SSoLlh z*C!bOTslW|h#B;u_tn{u6Qck5wp20uCQ>pOX!_077Zrvo)MrVl$EQWqUNWOUi~7~b z@t_30O5XpyERs2K@Lbia1Gy`Aiox7oM^YB0L#85nkBN@Q&avMR2H^yfOE`CD?+ap$ zMPz5TolHsWf|Bx7gzvvGUZ>ei3I4tMaydrTZ+XjzK8YGo?A2zh^P z$M*YHDK%EvM1&HFT5{STwBC!E8-$>`87E@?GJIDvyWG-+RMmt+kl}{OH@V&84Rn+! z$xXS%E`};?8^?T9a7{NmzUmG&ORL-JA<+1UNL==SZT5#EdzOv{_l5PzYj;jh6v2s$ zJ6FOUqkYo?0&|o82-*N$S8bQAjc&|8bIo`uQE;tIGvUTTh;Im=eeA7uq5*D8E0)W$ z2FzWo!RnwNZ3(%@Iv#Zac-j&XV8z1+(yELWqvJFCehPo^>)0oW$()A-&at|ssic5*_qOdDKeb2 zV(-u-*n0*P^x-T&hoWgpi2UNJK19@gA=n^)$h<+MpQzY zB2&nb?n;%zm)*fZMZn3;(xumq`6g^>`~JDaSGu#Vvk)o0^2j3bCP=jlL%wn_Glgjw zzyyPs`=Bt#6chU)?kbX(U+vlRqV{xBymSOoj~D7dbOqcApth`qZC+0xJX{rxKp)uE ziyDD^7Os0$reVf97croMhUUe;`=`GGV)Uv1v|E(8u+KWYoRaSbCe-K3I4<&}Ty&BT&oc<>o0w~Yx*JJLws>^cOol=43VHjUQO{@l+j64JvB@odh$ z@~roNF#9O*r|Gp_I%O`0k4J-DFrH*vWrplL6Hqi)q=6^=Ci)#t?BHv?t$$Mf!s&`! zXY64~eE1SD=PFfy-(0>PCi&EIKqAXauJG0$*VxYXVH^EqC_sobhPgELj^$amRKatL zQc&m+?D)HkUVeTQ|EDf!m4!%W|Lakpbiw^phwHj}k%J*0;|XHq_%~V@hImxevm2}Z z=;BjjsOTF-s3tv8NOzh^pm&z)+A2>kdAi@Q<+g(ci1~XRwSRR~0fn%a5 zl9vw~>m>71PkA?aJ3^?yWaz)4664vg!y`uwfT zV!<>Zw5?U!u|)DhrVR({0=A9y;+Tjya|ee4rPEM7S^fL9JU6Qv+veV#E~I3uD=(>@ zA*kKs%*)rl8#Ld!>J%(>HlcWDWEzH9e>FMaN&7MY@;+moCLx>E)Wog~Yy5BTH z{(8sJ)#8zl4YxPjZ_11s&}$;r!~-4^N~bJhDB@s77=!e|EfuTvpjf%e<5&k$(+}bU zPD4Hg8)~;`0DtvZt!5@xjw|7?8jYxs^m^ayoFJ$9t^=@M!cZw$WAKlH2yk zI=Ig;*q`mUC(zuy)J+f;nE~a1S|qYvrtsWb;>TMBrHLp)>RDv~L-x5$6Vnwp7=9O{ zPCmQ@c__^%)|ok9c1H*Q%+iYr`1!^QXh~W$G2y~@t9G)}c<%Sfy+}Mt`pkZtBGs0) zz6kY=*$D{=u6TO_bS~=h-^AEJW?&{1Q|@{dP;d|F-)}EJa>L&**-_ zjI=|gAMgz?aLgod|GbEfP%+VvZ;VxrRIlaY_+DOV$kMH!RxDnlKG;5n&64<-RXZn5`yvJ?h zNF4#}Ps2RVbq=>0ZRfJflQ=1#$bcNo-j3;Pwo9=Hf6z+Iz> zI>|<|e#^#h<()$`#~c9Z0tnJfWPb(UTQQO%%=KD0ZrsP^)`F@#(+_zW)a69BUo(Ra zv;86}jD%f4-+a;?S&TK-$Aze~=h<_-MRJ#qw&9jyko$Nt+(Dqw@IJDePn)`76#Gv6 z&3Zz3iI&)lD|s6OPO!^0C|k>K@3c^S+5%g;?-`ndRnXwmE7<=Q@~Wa=KN^gcc|6k<0?3e zP%RC8$ISBw2uP(~Y=n2}>Tuizy}27ASurz1-*oySEY$~S0{Ym{YBDza+A3@{v4`WX zb2wbUXC8ZQS9|uPleiMbHi7IybpApTVl(I3hU|bfV;Qu6cDztpbnQ0Uv=c%(om=2o z0~D%B+yzwU+xN~?<#g;;7AVOA!Iv(bowCy{GrnHXOFT)uNiFP5iZNSli&|xNGKGQ) zQCKR!?A|W{HePCZS039XgWb6s_ZFb{=}fD;do|yFx~M9$u|lz~zAIoi9$OCW^Tz!< zqB#=tz2=<)x8nB07L1qDzhH=8wTSq&Iha^}nD zd4E@}dVPb&&@oJ@B=-n4!#GRol7I`T84n7~>3RT zOd~ER`YaxJYp2%!#&qG&5KoTA%l(weGZ5l zw32!?$s1Sd2VpJkq0la7vTwx`eU6t2p=R3-?|EZH3O0VMk`gOs`1n>Baur^NTG{wD z&`r<0W0!)e{@HtAeWdFQ_Tx1Sndhz8{!@I|R2Z%nHr3TkPG3nF4bd#G_@`%W2_tHl zbtXmvMgfM+AlszPgI(1wUj0Q#6ZtUt$V2GfuXDliK~ts3x;tKfkLGg?B0*pu7pudU z088f`s=NUK%QF08Q%G?j?`H5($tO@7!v?>|&#Q?<=+4%>!#0_CQ5vprOX zqMk!x5?yhfL?X+kMhI>mi7cTK3Hea)l8}!2sn}q~FsfCa^-Dfk6p)Ait!c{4YzlpE zveiR=L8%BjGRb-(He@P)p8p9C*qUTX6RWbQtfdzJ0UzjTaR9r~1#6NA z*dB?FtvzIsN!SdGV&ECuTHbGV-=E(u6N@D%B&xTyqHh=U02Or6y3ru0A((CLt$ddt zh~td$_t*z4a$NJL9i`65J=^^-D)n-CH)6+fIk37#*aDN+A`fTaPmE%HQJ9O1><%cF zX|!lr9TFcE>-1wcn+s|)OuCWCpg~P6b0h-i1XAhq2qk6I1jeI)R7xO!)u-bRUYl!;AE8;zO;+ZH)hXtPn?rK|C`fZDV3=}Wvp`=*wv_H=Z z2n;l7Jt|7nwUF<){z(6);Hkz zF}~d!S3Iu>OR*0hYhQ7&t6N4n#nb}qAqhXfSalawxxn$JM#0`aa(bdM(3C*S+R}IL zx9afE^ykaHV{hO#X?hdq)rb$uAg2&{G&lZ)((Z(ir2;N z*0TvlDaUCF^G#JQ_VlVN;i)acgWtXy{qDc=2910lGfS}5^XiiFOlLbdM)6={4hPa< z1Ggo6KElyHN@vS|EakT#i5s?m zmtnESxsk!Mfl}3L6T?-KkN1(9=vs1%PeTT*Q9xmb>a19(+Z&qix_${lwCQXl z_f)P24Mi!rx>qfJ_U(-@q+S%gZ2Z;N?}S!ie9OBOLl-`=}}B1 z`AKZ_xE&2)okN0vR;c6CBldOpjtgs&f7EqC_lbz7Vn15=#*O-vd}VA zptNI87G*IN7AHOgr#jrC|I{8kM_6Rp>S~eeE*My@`Rt9ID^AA;o&h8kKmBN==XU3h zGG=^1L65R9Iv=h!Qm!Q39{o5>z?$;82Ywo;y;Hb1i+7`?v>j7%=ka&Fq$;TM#hEH& z=C?U0o@Q%cO7zz5koRUgW(6~8z$}h0Vw|baphHa;wFb->W|b(BaN-wp&^G4AFvpZ_ z{9CkGLckV=2h0d(0+1BF69(M~?1HnJqdim~+1KEVLp6$xg_1NcLGpF$&a4FDl3v-A zpwkK*6eHu~c`F|mxIr19KpiD!R@1+$=IdgA{Q7}L16q@ z4APmiEx(9z&#fYjy?EI1G|E=f;_4iiK;eCCDmN(Y*P@E8n!a}J!VES2`yJ(3`K&Dm}8OV z@nsG>>ySOMuH7+oNeP3!9LMOrf58;eKeVdDgI#94!>0rii{}tQbRA?55vf>>)l5q2 z=4S^klSD5%xVLqYc(g7?gEM4E4(6UReCu38#Mk^T7Voa~%{#(Q(!B2)XZCoAh=q*x z%C*XA0b2eQ_mrBmI4)s}@yeB73KLl<6Yh&Hvb7D9J*m!{nx!RHC&-aU>V)QQoXnh7 zkI_PMW)WSiwb?`b9z!(avZ74Mp!^F4O*dS=C2CRY?Vh&53#S2BF*m_>{U=^h{if{> z!~Rj=eWG~kF&t}W1C;Iz3YY*P6bm$TehCEwUM3J(G-(-p1DU5G_YemP;SPKOZc1s| zIquJCF~uarII%sRU1gZ7SI!;~|7OVz7C~Gg%sj7E*^|cMo1{8my?m=7l=+ru57-2( znusomhSkwE=N^pW>U~#`Zy4JStrazrHEqO}t?1cOHtY~YUuRS$7K|~B4W#6T(eH3= zu8}tkM@|XaVD2}bvcB%39`AOxPI%G{5$yExEaN*uB}zd!N~|llRBvn6W!d8jtefe5 zHAB*r!WV8g!;82%Ar?z)oxG<)TMzz)Zjva<3~l@*19PM=lhKTG>4=98bt?-vLau~e8Ng^1p(ybFG7(wOL+PxQ)S14pXGvx1IODXGnZA}_HxisPBN5$byA+> z@z8KEb;9+;8~3=uB%v!^B;z=u3GcE1Hat~7;dSoavyDk2Smo_ zgz(6IR2y^hc^}gs0M`UA<23jnfO{|d^a+yeMsExrX(^!+6%SE!6bVE@ZmsR9 z$})6ZaROj&;_Vl3N4nZAqeZM1K4NR>g(#;>g>E=|M^tmHrC6(q7Um*V^L(XA?AsuqQ{MUhLqXz~^dP<1WK} z-nvf^rL8!}KLN#t(>z5iL zCIg2JJsR?Gvd^=Cd_yeL=$ePcK2_3bLmd~A0TUa~uA6nZyA_Ix>SVpYF+p9Pk7Hu?^T&jVveN#NbbN4Nvf1|KIf6jI3V3*0&ju zFa8eWSx4QC7_fRyZe7E(UWG#3tbG5_(bNsqpMep~6-q~yki{f47LUEE4S@7Y&jo6{ zmeJ>+J@+@e!VlX9k!^o%^s~^jojM}qQ&=j|0VvB$C|7ruHJM2ZN;>|CDf_Tc&v<@< zKcJUS>~wf^Zw8xJSYpj*K0U~xs}^bsZ%&QE?a-55(?SQ#TU$seg?OKbyAT2!pEXl7 z3<)wW9(n=R@5?x+b%h2-Axk5*_Y4)Elhh-c!d_Lj0`ZA-B@Rc6NzBDwOqVn>jO}V* zx|=Q{Ev)Ru$~HkZBGd85Ys675EJ8UBS6$suj6n$`khR|h$kjuIQ9<)vSnt>=`OHaa zw|@(z1v_qKh>JHp1|)+DIt+yh#JhJhh6i#}akIo!BT|R6@{)Xb-OI`-WyO25ir1F# zZyNGntJr2T(*cVGNuYW=gT>S@6ClS#sV-0Etpd!2bG(eelT0Q&rBhpp$)-Zo+p;uu z#m*Jczda{*_@~=4=MgXZ>wQrXl0*sbNwHNOyW4Y9JLV9k^Ki`?pR^KSR{Mw0{d)Or zaSOs#$yw6YL=)P?%w;tkD&I5wCF4BBB@NV@aXb$$#P%SGx~ice(O0YJjD{H#9>Yz8 zG;}(gIo4K5$0oVny6-_tEYMXn1Y#S#G(_HiBe#eL-VurI1|8p=edS!;(!!C0$SNlV z`6$tdHpFDhKEibZ^e2^Fh@Xmv9|Yjs*@zd*f1`_POJ??f$JFYrgq|G^LHNUtFP{Z5 zBpJH79g02?$5ER)jQSl$YgvH`9*d<|q*YT!CmvI3d5!`D?&Es!(=hr5_u;f8z4e+% z-k#e_*|T`Nj&}RChSsaKG5@A@M7u?NeKi2$Mhh{Dt?|r68xZ8VU?=Ka?}RbhJ>Rj0E1aTspoglP7YGc}++ZBEgM0jtL=6Ho zmSj1qVz%ZoK~#$AUBO%sb|#&Q+x#1P>;u2D#J0ZC%SY;`PXIfYC$cZJP|7SD7FN^7 zv!6PeT99cw1+Z(B+a?tv5GBicLE$7fEP>{!N;cf2I&B4um+Mh|DO#&3}6F zSQ}6}PZ@6bAd=j$i6S$6WuaNc#SMpKJa8^PWyfNvwnR7Kd*A)w7S1KJjS^zQN_~9S zccg{dmE51G794LqU7P~QCcOr;XWpLWD~?snREMJ|nS&2H}pN_aS~W4j3*&peIgiqUNl( zmQk;h4dE6%PPk+>ii5DIhJ40VdQx8>^p%+<6581!_wh(nXLBgeYQ*Q{X9-77+k(!B zIyt1+O#_7mmO$&vO}0SJ(eM+fTc+l!&FoxW4I;?7j^*Bc%z`2MQZ5P|mnGdeAOhCJ zhP8}GC;GaOvA=ufzRtYF@ZM)3(Zrfl3JNjF`~pArC6T}F<=5w+#WgUss0r$rU)gks zK|vFxu+XDUCAF`2*+f?28mHYfsp8uP(&Dn!orm`Zx>#vp{=4(g+arjv&gXKrjpQ>3 ze*FINaaBEN(>+);(65n6;~-EDT{qFY-Ub0@f?7Q`CsQJC+=Vey>Vbs^=P<<8jk)Qd zUhsaTx;pK!Q;A`Dl^mp&j`}r2z8kJU+3?*aAg`uw+FT(}nhPDoPKZtP2(K6f)P+-N z?E?JD)nO8kMQOygP4mZPDeW#>X)aO8Ut^m!?ecuxEDdmdv<2(BDE1^7j8zaoEs^;) zK@j7^giFTQ7)|KFm+v;PX?7I8-G8Q*?*q#tzniLt3aC3%YUP9qm~a#X#i8S^MLqQC zKA;v@2Yy64Q|M@xt$F1|IE7F`c<~dV7JGk-5|>JO_iZl07aZP32S%QNNAh?liXc{0 z-6}ETeN;U6hrU4LTlOXCgq(D_Od@Hb!tIE|iF1k)3x_1wk)*jsUiZt+cv6#Dw)3(G z!fMqE-9mNDK9X>;wxk;UVi^x3p1M|KvG68~x$JoFkW@c4(T-*65Q&NKQ%p1_{U9vn z9HdBW`UE5iU#F=3IpjV(st~?J(p+-hD(Azwr!dWVCnH*6<-=i#Y9S7;Hk!<8Q$IJC zU}zSUl|@9WmdYh>UUV{C>i&KvC0b|^a_~t&)GR&@c0VRjC2~2>oXb1ilaMPec58V| z8;BTuOaZFF!DC;k>ol5u%UnB9XBl~^_W#IEFMK8A5UUbFM#KQhX~ljyw9eb#1UXJRV=`Q`x?d zTUnnt3F@rqWW9_u1MhQ+e2b*<`7Iw={aGJ_k9!S0Z_sCwOL0!%bc8&mCgeFWE^?5Yr26JfVF~0z{zHmsW2C7umI0aHCb++*AkB795nnPvMt>2hv=JO>nNx{bLpwq zvKV{n;w#Ud1_mub=w8!Wf6;}732nfiWsKMiCA-3>L}KYnt^I@CTiCyT;r-Ux7z!3| zfCcD$WkS~(S2?)lLfW}#AUbGrGsl5Z^+iO!C&ZZW#B>zrsxq7p{&!>R(2HMm034U~ zY%8To9~y7l@EhmfMPdYBjyp#b9L2mF2yhM7-%5I_0ne`Nj}#_=4Qz0&9uB!o*;Ahb z+UbHAg?^{3>=f<4hLio~gpW^#eUvBQDPU;9L@oKRZ?n9E-j;5fX#?J)3fz$_^mRUq z9!pB0`hxMA^c4;27w9?O=AlW`q#zpCg}_0!FL3fqp3bOjOGAnWp(4i?$f+TGy}{h3 z3E#6bsrF8Vfr-Xh)M zNSXdjcUQ5Q*o?c9?jQb`P0H48?3$e7%NXyK>OThDJg;#hOEx5aA*YC$7B+`LJvOJ( zzI|Ywz$!-3x|kdJA(m@dy;Nx|Sz%GX!75-ZFx2MgL;3yb@dVXUOMlFD`E8Tp~k3I$;;g^%_=OH_eS&$GOZe*ULy>^K}=#?O7u4= ztLz9-r@0Y?i1eQ#k+$ZuvgGO+7=W@+dvp5y1vm94;z8-8OnRMAVELVBA9X*2B>xg!vdruqqb-`9S3!n1A-=F1YP_Ny$V zt6AIYxm=k0h78XytB5YHjpwxn>u=N;)uDOKek@(g+)J~Ez9&n+&JXnG>O0Uz1#$0U z#7*F54K-dtb!IJ>NMVyB$w0#iz3p+OZOWdBICN;n!m|(DI1@mQ82rmQ>qCDRsp2sa zqUNePncFKmT;a2yTB1jC7Y>uBUHQ|N#JQ}O+j~@Nqk023r3d^gudh*E}rY7 z;u0g74(ws>Wz`7I%>2AxQ%kJLgBAx=%fwsy@wQu>&!DyhOrliov`7S>dbo69_xIXB zrD*RMv2gGS2Cv)LyB>68S~^u<$g!U75UJ6mPq+Bh9RVZBP!i!)doNXeo{Fo(-58`? zxn3+=bG>{I%M?fyXd4JE5V*)_U1SUGRno%D$TO{uaUBI)Tm#9=-|mC2_eNc9 z7zzy+1?JW~zg5J}qu=~A>MMufQ0k#0&2Jy_F@oVkys0UUrD$ow&n1YN_Qintorv(~ zDUHN;;YNwR@LAfH*>mn~MhaC~1`RUHHM_G+(UEGP>Iu+(fbAfsheJ-=-sKY?bef>) zPoyRG)*LDGmL^;VNx}>viHi-~nfu0L7gF;lR{weycr}U&BmM8c9d(Og-fuJRz*T^H z`vC9e`4ySldU{tiY!8F8>f5y>EEf&q-gf50h>xE6mpS71p7vnhNQ2pvjpex(E)^RmdXXOG2 z!n$ZiaVC{z(nW~okKqv_X6X|TDfgwG_(kZ4tH;VKXUp9DQB`GR4t2V8wvd-CK@ ziETdw1as>|`iM_KM+hei3M*`GoE^QTJ9|>{CM=X&zqJK<`t-96srhx>aaVNm?&r=s0=SN4F52dP8XH*uIc+B`naH%`Y zPR91_XB~5$CR1xIMFgJGTT@l6r2OiT$o(s3gCrHkL$u0p`C13nEM((S>H1i! zBp8izs~wVM{h1lS&FTcom8NH!l^4&u*jzV}_cJm!DCY~OQspWmeNr+7MN={Dlr&$jNncP=uE>ePLZ$TrB>`Ui-Lvzk%Z1| zTo$G6Y8DnMu-Krb-ND(Fm-RkE<;haSvIspY*x@=JDo=Fty{js z@PQFBChsQ*-<}>(6-Z-&`KV}<=GyE2RuN%Ic&EE*>1a<1*eOzORzx?+G6fS#~})z3050@ofhPVwz7P_DvFE67R%1~RgrenuHeAL@7dCLr@jaz zo+ydbFRX%&Cfc_I_DP+95FB7Y&!_+;VYZv$OctZu9-&ht*E||VeMA5#m@8YCjuvXcKp9UXu5Gj3_M}m)T4HAgV)0U& zybEp=w35TtRy&Ng&jdtK{H4v%(;DOS`V*SihA35hp;pyb{QFepP{=&q)mc+nd8v6? zujNENWAS0ZD0<74_z$LH4RM159}iL-b{?`Skugq&Zx68bSqXFr!rMUH0X{;yUobTw zdaC3t6J$09(aHR@XFq&X?;hJ0oz5iQnb(-AevhuEzav2Ro$4X6B6lWe58Z+%7LJS% zoW49QUtixhAbg@*aEIvpfK}==wHLzB)fNBzh2ZIVG`w7-Ckpha3`WxEG&#{oXZHJk56TQaE4<0&0Wd!0OwUF zp*6cdk*Q}4WLr?N*d=TU2m$)a<1^SZ!taIjEVA{K&4SqH8 zQ~!gscL1)X=^u4t+qP}nwr$(aj_vFiJGO1xwv!#(zIngzuXE15Rj2CKs;TMe?&|){ z>X}-Y?&rY`q(%EWm8>W$Vg`l90c;_v3YC`rw z_n2qvqq~%pCTkC;-?45?CfwkKtjEmJ+aK}l^(i4-UASZ|w7XveeYHIFg;{!lGX}~p zPs8}2&utMyye9WfO%by#LoyiF!RyRE-Av5>#p~e1F z!l!UDlp+S@wy5lD&ikPdPq#615_(wvNWFb$3Da0%gX_3dYFZEGU=u5+q!u6T8k*fp z|6F6bCVpTJ)}W5^G)PlIhKmVj&=na`H0`&Eg5P>PTIMD1dNqh>BGQ`O(qi za2C)_HP9mNw7mTwj6!7-7x6_|aW`p?y6*1VkYrS$@aZoTY`el03$|9oLv`IP{$jCVJAtvfI!m|(E0Pt(idiuE^2LKpA zZC{)fEQYmh!^o;NaroshNzsd&7X-vz+{M+SNegvvB8kSI_e+z)U1g=kBd; zF67lVn)Tu3!DA)i(G3s!GBQh9oGNa3wv5%8{ado4bCfv*oyMj`76C{3C<$?L2EMnu zu=ls*VJtw2pN|Ctb>N?|#AH7{Q1k9{Bo1Kd3oCl*I`C#?QRBtP5S;AaimJ2JeFOA< zo0+VZdXR|ehRHd&m};Y~HsHRKYD49AN?!G642jx_2RRu&$yDEi(PzNo81u8>Fmnv? zud$S=0Y-#vNbUhwqUd$?oPI%SFi>SW^&FP!pRL(4QNA!WrCk{$wu8jmOoJx*R@S@X zfEy``1D}E_N<%9Tw2%gx@UQy?;NV$S6a1=W^id-d*6* zxna9(74XE3yE$;O-VzHGFC+%Rj6lBg)i^OBA0ePCP|Y2qm6FIGylX%`O7GUdt!2dD zb0Y7HMwnQZ0TwsV+}1CHaJ18WK>8g;>pHqPDni)5Gt;!-klv#3#bg&}FWaV-!eB&(7Gl1vg_6j_x4pt6dc|YcI-l2j`B$mKJn5e~Y)rruw z1@K@k1xJU7&RRb)_m3K`Ca+CXS=&k*LXr*Gj8!QdE8sj=0t7Zm4}8?P;mcBwVlX)f z{yx?A_B141=?-p##sPYkh#h$_>SZbhFNbhIC7|>!%2I0HU>l1MqJZ#K)QhZ+lhocy zeRh4`X&VqUa!5APFvPxE@TRm}T}n@5E}CTpZQt)&N424K@nqIDaCm>C>omDOiR`Wj znvep#iadPoHP!b>WLax#!kGd*VZwWOYV_8pbt2G3BJ|R|mHjGDZ{r?#gG+nU(WPtQ z6=nX$yPK`G*C1#OfZWy0HKv+op4(0HNuuSf33FW}2;`P15L7)l>^y-g+m{vgAIDVm z_K^GX2stknJ?5uo0JeX4ed3W}H!sX&N#rqB3e4&0qwG0Fjfn`$(a1_YT_1yV|Ika$ z+`>hX6*1dfwL9h!WiGU$y_QZmU(Oy*b?_$4E^Z_~5oukg%aSXV%WhwhZxVfijmRMq zOCM9+a7&2dZ;G?vTRK?G5pz>z)=N-TMd zqNPsDrG+R%#dqlff4?!#3|ov@KEVEao#XZvfv_L`>J&AHqL55#ojPOAv@tNBF3gDs z*8Y|RhbzZ9g`O`a-U6IlU{Wzsz4qzS|G^r;nP9pb+WJxBrOIPzYW7WJjXc?z6C^vZ zq`!g9zFS(&ywI|kdCXbi8q42;G~oK%#}jiQF;M1_)CvOq_HU?x(ftEuJ*qu)?Q=Qm zbyei_i80K_=@z(+n=S`d{PF-$pn>tMe>}IhH|3=2#f>Ow0)z5pUlu$(psud5?>-d;f=M$T`Moo+7lzgsHwrP;M$V0qfvf`Y-zP@ zGk#(D?+|S29!Fnn-l@`Gyu)zrJ<-}!Ch=xkdDC-{mr0IYsJ`m6vd^PRApQk^1UxDt2Ae19#>j~*M7nStnWGcO0k+l}Flvn`Q0ZMFt&KF-B zM!REGNKBBjW0|U4M66%&ztk{4-mE5O(V+6zdY;oN9H2Om0zNcoV;G!ckej(1G%h&U zp+3Ld^&`mNy{G91V<^E=6GY?lV1|!3eFE2kFh>JtMk1Znna-bNKjcuLRKjky6Qw%K zh^q2hU9Jc4+%7HY`0kQeh!DN;i>{Q_Dauq%RleB026K3iP7PSL{&0Mh7{9&ufS|br zGKP6CR?T_r34~xHnC9CX%qO|zESG#ff)cHj@G%52ncTk_+A%HTQc4%>BB2z53 zoypGGy<1c=5W}lT>W&e>0M)_WKo!L(^4d#FJA?AB>4(aP_*&dOqHNDHXVjaX*oDY* zVL3uRUERX^-zuu-+088@j+tPqOT;W>EUeUKPbb-Yt<0R$oW4xu?A_FSGG9P%tQ%ys za`skP8q`P4x7o5;p24Pqmh61Y6WP&#b8YwLHOf6Cw*0LS)=jc69R&+QaM6!skTMV- zAC4nW!*?(Igbb>LeKQ3UUtTZPiQA*v%$2ZMKDr zT5UF-(cdwC!g)R51rqMY#sp6-H8wo-ReD7t21b8WdslTVnB;8Y;+~=+V-Y?S=f2&T zBBt(r96VvA8j{+Ptd7+at}QZjrghbl=swU>0N&xH@9TuqUvfp8+{()lznFeph~p%& zv7+_}9+QU=Tr8?iy?G~7NWQYpNk+Ie&bg`CON(1EkLxae-yDeu8`UiIlclN=NGyctWa;DTZ6GRZOvrVJNQ{N8-8mM=3xyp z5THb~53bfX5EP;xTl7xuNC27TahH*3;h(&HXUDB5VI0h*G|5~vXtUbBPEu+&58mvk z!i91{k9-tS5tTcHJdL@wDxjW?w#DH&^KwhV7C&+<$U794B5}5w=K1n;zZ6S@_r{z+Qd;0^VPFbiX=Gu7g z%K>kN>B;H@`K(CMwv+j{g4NaeE*1&pTY6;e3-{y^kW@VQ8N!>^#3zt;Z5opTxjB&qOp zLvKoBB!cN(sD>jkK#8BYP|MlbUSa20Em8m%R@K}~;jX71YD2PSl1MP(TevUqn}EYh zdt;tNZn0U@+cjTXOjOP1TZCH7yz(hWIsvvTm%yWy(QW393hQ1v0dL2m!msu>9VXjs z^mEgrUz=;2h1qCFU#$Gjf3EfYnazfCF`fj!5KJCx3Q&-4MmFdhV3&@zSz%wN zSsE7`5w)ti9;IO$z%O=x zU)DLAk~I$_|I-6Mjvp6nhX@&6^)~sIyS2=_HyU3UC}>kREf+jF1ghVcqQIJc{jd8x zPkar9WZ{ge02RDTK6YMpDW5fN-@~CbDyjjz5%D=6vB_stvB?c9egjI8{K&UuSh^AX zYTf#Ho@4c@JG?R9^b&%HX^QmGwE-oXU^%pu*BGlB|3Bm1fmNJ5%U{j4{e7pxU9+8q znJ>tGS%|X>Pihu@H40wyQ&nuPOcf(UyoztwJ!)7(?W8_dLk(NCbG(G5CrGCJFDHB> zBMWXPzqouQ;=T3FUJ%#{qDNuNm|t%R7P8n!8kyt>Qdqc}BP`D-0vT!c593p}(M2NS z<|w|7u7eJGByb@^LCIQM2`UO`pk?)8vMzV4ftwDJYg-NJBf-C87J_fN^^Wpa zivD)iTDB)y`oL)quUD*??f%iFB4A#iu)gE&seK$y|ko3mHCK;5Z}q3hT~S)U!DT0k}H#ReOrN{GB;vu7QDq} zb`Yf|^+F4cyu=yjKqbtL>(_61EcXo^QSOtv6>ucOnXL($o})(0o!TotNcYb#_M33spvrryhEBUaUGm#<40cKD z?(ugX4l!O}FI_^-u%uNs?L0F$EtYK(7JdX z|AeU(vt>^~v@xj1zy7%9d{YWhynXi?Mb5rU77*)$USCA3)RZ~T^~sCjng88k4xP#h zwD9U%VL7F|0)aTclPfdb>KyT|Kj}od#Olhlw$V<{A!$;PnHn>@z2AH!SkIve2wYw# z-@&7?Za5YAd9gq-5onzI8}BGyu?%3(;;Xih>HJVp&dXn+urJ&z{s8kBq(qH5PzvNa z#zo-4)id$_T04Y)X3WNC=3Xf=lGco%`&^c%3@yMkuqJhclvbvy9+&t5zlilfWlU|$ zy?O*Ir|>8=-N|l;%$a)#QLm{8%WL^-G5_dnzEfYw!pdP$+X>0`o5=hqWn}3HablJ; z^6!oNt)YX$Z5q>oFj z`)-A?{m3tWgZGwGHV5Th(H?Lqj%n|M`ESfYP9KX~4&sIAqu^uJ_j0O>Vj#NEXul9^ zt_a@gPQdEb8w#EDti2xrGmPLsyj)W~rW*qF)t1`*U}K0QWUd`r+qe~fzGxaF)bx>J zGNWx<#_#>DX2OFO`({lP0$Fw@n;Lpy4)Y#xr5Nt$%sOjBtNt_M#4)MGl;S&I$e79& z#)&J`w$1zZ8GWSE9j%lF`CTR2`gL{|taRQik0ShWKj#!_hJ`FEtDO+Hhed|;)4e5@ zyW{UJ86;CnqhAru+y1)c*&WxGOm*1!BaTpAmb=gZ1dfm$nKQo9NGibX;Ux{H&6X90 zT>?tXhKDiUC^?dE{oqW3Z>Kg&1rK9jw z17FHk)vnz-Ndngk=EuhujCnzF_NrXv5R`Ia-+XkZ&0Rsq-omZc znAU)v@INzd9#~)HmivWHEQ95f?UR4vTu`%DdHa{md9>pj7oR9XxqzoyDF+) z7Xz5z8Q~lil`6pMv|;|f7*vuwZg&sP0g*cxse}31I@N<72eQoPm)YXNv+qB5?fqgc zBnrV**x`_@Zvy@ue4wIni{67ck~N)r1d-;Hrrji$-r8e3MTYX!jjDHhFk9#OkZ#hn z#>12yH73m(9Hw=q!yhS}^*j%m(OaFd!Y$#gW4S*H<>*04Q4y@N@mH6UJjHiC-oJqA z7sL_EYH}J3y^3(#jS`S(!ZjrAVIRFMSw5{@g(-785cNfPXvDYAHY?%>r#29IWW1y$-!a$N5jfHV4yE8c z0Ol44+e(p18p5r>eC z%kX@YUVMXpBL|=k4)<>@EUoo#LB8|H7F2!zpS^%syX&Kqr{%M~1hhWUaNWjU${QpicHnXHR`>{v3+8UWUIa`|B z(K{GAncCTynz{TtFw=I>0R7^=2clZnVQm@*}FQ? zn_0S<(mPvv&^w#DncC5t{;L5y%b$w>c2@|}3(*VHi_nYGOVCTw%h1cx%hAizE6^*_ zE72>{tI(^`tI?~|8#x&oTbsK4E0F(4|2q^zdZYhMeql{-LvQ;Z0t`p`|5RYO(Yw=o z(0kH*{ZB6Qzxc=hQ-txa!T%Yse?%CpKiY|Z2K4{Wi}io#GMJf}3I5ssY40DD^gro; z_6!97)cU{K{$2aO89lmLKx-Kc%d! zYy_+vKbUAv#(z%a=jfjl$Io^4PcG|E$7~FY1gt;rD>El60n3k%gPG}{yq|J5)}NqQ z2v`|^TKK1xpT7SKf&CNIf8XH$W>5bMO#O3#|ChLfjg5ojKM((Ra|bI2>;Em7y2aST zR=1WEXG2cTW~13QD~-F^)o7zx{^#H)W9;>=yTyLT&+fVA>utm@hqb~g7E86@ua0#R zB4zn3Wcn&*dgR6$*8<}lvlDVTr8NbXmNs?P}_ueK0o!XtJtR9M(cf6XsQLYBK1`I%=q z@?UMVgs;y*6=hA?T`^@<_w0k;k7B6G%0lMQ%0kS)nke(a1M^doJ3$DGf;+MDg3GGP z3i4R<@}m-1d(#xq3~a2z^o5>c-F6V! zcDn5uM7hb$$&JN-busU`tBES!e(#>z7@mB{+mZLSWX?`saL*4;uO8(lem(jQ_;_c- z0yfJ9PZwWJe;+b2k+J}CtZ8F=`5b?NHMoO(NDmA_8d!hn!&pG#%1*)J%2vu|XLTEP z*L|N(`!7kp^r+Zd*xO&;UfXr}7krU}|7u7oYr^D(LB4mFGd{lF{0pFs5$Z1{I=(y^ z8y|7Ye?dm~^nL2g>iW?lnEX8nv&0T5jLfZV4KIYO%!~o%$$fmC9Gv{^PPOpegZ%m( zF!(JG^5y@-rRI11?hyN)ApH9F&iUqUY>jGa>dcEd?a74rzK-HAb{XZ=PCO31n8j|L!j{Ppv}Nz}Wx8aO*S`_>`-y}o24 zD}!4F*j&70^|c`(#6>1H{QXzC2>?TT?Q6lU`P(6VJ>$duYzOF5I!jPWQ$H9M0(8zMJMh?HP=khuz4&CnF;p@~Xz3JwD|J`0b3*#YgN_ zzj<$WM8A*Ub_Cg3UD;VfHMN_W|3cQwOvt!b4^86cpe&tUn*!m&HPhQF&{EyhG@su} zLvQSrv%Hi-7Tah2{j$2(;A;5hi7)2Exg4r3K9OYX8XtKi%sZnN_!8dk6LiMt{i6<* z>sO6<eiKASj+PNUf(nzvGrvQ49QLbOD?~$;81_X~+pZAu z`b)UMVp@qZDkbpqFnI-xq=!+*h%r3)(X;M8u3}(t)zYuUMOy3e-s;H9yYrrr*X_&Y z@^nIeGj#$HD$1mCxA_mcQGIA^n#ukFflW=gHsAXjr3oPVZkb5RJCHpOgyYEQGuvnNjic!ub0Ck`5hQX!Yg)sqfbwVxt0dJTcZIA&5VMk)E7 zyxiYt+TJ;DA9dSEHyYX1@lQ>73HAU-MJQRSI$!hc4)m&(7R5yMtS;2h#y$sEg%J#Q z%G)=R!Qx$3Rj)oZ2jj{9E}ESMz?5~6HgSBI##dErFKN|w=tzrg3WW(OM_KGI%kf*( zg+j6mH|!COr5X7}U9^w59izxKA8o1eN?_pFt5hSvRtbR@34f22#N`{WQLCmdRQ zPADEd0ONwr)g3L}97!#U`;bzNf%>FI(af%eIjl&P6>)AcXUl#x_r6%aK_o8cCe`+C z+D1;4PH7#1P}}knQ&%E73NwH88tL`Y|B{dY#nh<#i^zM%Fx04Se`+M{{V@-asRc1f zuxVxo{}^rm$S?mglyZZ;1od|~P^G!a5n^_vcB2Lbk}_g949oS&SbmjJDUdQx+rD#< zpqME_iMWOIG0xPRZdfoK+FzM05y}JLC7IA;`qO-R#ML3?B+xHm(d|_2s>3Ek-wb}8 zjwC@_4yBd`T97K<$P9;O*-aXGZfcukg_ziTgceI?8<5*iy0hnU>1w+SzfS_^p=O zTG#plMcDPN+}p--vkVDn4?~b;q^Y27dr6?0qd0Qu7GUutdw%ZUGM(RCu>J(Icw?9w zy>?wlv6j53fg(q~k#B;bq7#wuE+CLnd>ui~9TUw!qK$-WUVW6zId*GGkIj8>0~ylm zwbqT6+-!58Z}5c7qi%Ao@HWR{;FY?6nfWsq3*8=}Jv=&p(MTf6>%Fr!<@^=ueECC# zA8I|#Ki2#n{~3_9|NR+4{2N(}a%7fdeST>Y5s5-g=$^SqK1Sx&b_iqAPyyV#;Y~qi z{UA^7QSc*V3gP3|M1KhP%t50bU@Uh#ahL~Wofa}K{XXuM=^dv*Q%e$PIyvm71&+}B zvkv7CXcaye=bH!U@rFVG0r5lNg1TK~|H69Ng2KGHki1LFRsNjEeHWq+U?Fv?WwR(*(T_>0-QWns zKG`l_QF0QP2@^>fE3d(kh~9=U;A>nEaV%B)W%)=ca zwr)J6lGwMUnYP<|)j)a@b8{~WUve#vW_(Y{s>-L2aj(VRTXrpFoi_Op*b*^ZUuI{6 zpCUl;wpt#1{c+!d6;7;itAH8lLf`8$f$B<@?6?y|mWE0E4doqb#=Gnr(8jLCPb4sU zRRX~o(GQ-4{k;iH8!Q+JndOH%S2uvDzfVH;azKVVpqKg;W_AkflQ&WImcvGy zVnttNX)TB5{2EwxLW>jF3r0<@`&B3xT(v96fD62&t{gGJ4UURx6WgimS{~85AGRB` zXK%HvK0^V~a1|gYg{x-mGJ6Z&SxmUx+ zHq@N6TlEnsXbGmMr(nc3I#^BNxjS!!9|mF?UL4+xKsUjo#&jdgrQ5Cw?%Wbv9}kPhdFTj5lRK^)X{uio00e`-She&j!m&Q zB+n1#jiI7k@lcI6U;ooQw5yf8CMKo<=DZg~&BTn>LwW4EL7uj4F3ouFLrlCxi|D5V~J0kFoY^6jPyIY(hw8i(yj0*aCD64BcdBD9i`QWh~2_v*H?xrm~1aWaWl2}65d$1W!s zj*-R{x>5qa{b*+mjN>SoPFn}SD`zdEH1#9A{f1|k(y~k1j;MFlU)EOOY05xbO@Kse zmrEI(%=x_~UNaDPS=(#=sW*Jn8XJ;GCo?fvnn2U~zaO!WdxF&42Ahvm6M2yR*6@BC zGDdmAF5Lm4&@6;F!Lm}A=n3mx{=gVJ)YBI@qMBzsQpo_>>J+#}KCDlXA3GNo6dCcj zd0Z?Q2?hntf&7~Z0MlkTUD^2V*IarLM`MlM9_Ld0gn4`E_&SG$av$&&aZrGQh9Ta; za2;asVqlK=YUk!O_Gm~J&gNK`G~j5eWr<&dWk3Ze11GZ&JQ5`Cy!?)muk}hvU z{QUKIlYE19@Nao&=Q4*d1xf`)))ecFM8zH_gd9Xp@r17@mP4hBU_9|_SZ&oy#2j8V ziOmQVBwq354>k`Tw-SrUJk!?w9i3QKYcw~%Okf(pg#M^n+oY0F72*nHV3$1^RBR&v zP%YaxQ=yjl3s)Ok3F;_KqFsQOwTq%NV5y0w=($V9NcO!1#xgVaGxDRE<@k&hpD?xg zEXOkzLh@C>)Yo4kZ{_0+I0MLb+T9RLZZ&0(sIX-#8-y{7`v>2984G|qU(Xo3!--B- zrI)1BpTk$8xAcOdE6x1{1ACVwH7taDF6Te`I+jkuw(#PF=!^!$WkDzVJPG=koyogX z-@7B>xAPybQ1wuAFq<0NjH8sDEZuOY-f@6l?OqUMf*aatL%tdW+cBwGK zzB#`AdZu&QTwQ=-R*!X--cH%0rVSNzw}08heq(H9q~#MVy76sMX&o@2+z8BR5g`KE zbMTc7AzWu;dzyEsqbVm@iUv-3@v{y^j|%g$xqJUssGZbdvXX2+1PELuaKgAeKZBMD zkRyE!*iA!gbx77$pn$8|%Q?}7-?)t=0_j8dNjNy#%S{xG{zQ(Z59$$6>NBypGkX`= zW!2+=Z>I%2UYEMBN?#F>2n~zqK6@#B%1W(YzC~TaP41W+Ok2N=3mG4wHGyqWSH!Q> zqv8>CB3ejG3Xh2v$s6GfWvP&KID+9|N+hYhNfI(9DY@>m%jYcduPn3QGzp5M-Hpl6 z!<0s@;)uPn}%L!$v;elkjbFZ?_OKI+x;Jq$w6J1(~;gh|Crx*}2eyHxwwZH|S z3wM(q({fwvhr>+tPEgf-)+|698Jw}EB_@aM2UF{y!O=?_RI@}+65Bs#ZNK%FwnxG! zo%_c~doKKsyox=||11VAjHo6f+9G0qeL1&sp;8i4 z<9X;OYuKjf&uQ>CIEnZOMn_AJVcZY6wsnZ(z69tm2 zsvM65u<`cQNIG5P7AgH9cHodh#*|ECS)evtVsV}O{Fo5506NBls&q(Ht(}S*AT~s< zpWse?O<6?&e#$ziuM3v5rst7BjQ1S9*#>ns5lApUQg)Igyh9X%zOoaAPy$<6JVA1l z_rHU}aWTb!@QrgAf{rOr1uIXBVg=RB+kKs{bC1EM%sr1+q zyrvR(opyk8ewx7!unK8g9!$eKY$#&|;xPO5dSHb)$p zyP*z3VInMcS06Yv6b7xzROn?RduqsY)0UB|$-)pHtTOvt>=4z86(a-bjDe;C^*Z zkc&$Y*6Gh>O1FV7?vWify}5d!j+RfrF~56BpOa*WKYEVeQZ4)qjLu$oYC{Q8;6|-{ zq*{>+^;!lAvilXqmPR9Zw^}$5%eA0jB6BuDQ3Z4n$DVN}Y9M!hR?J(yHJU&iVA3xn z0J(f-Qk zw()TJ?2GeF^_`fV*F6L>yE^b-X01s%%ihCpfx@QCnV~5cN_2@3%b#-EPpf0!d%g*< zG8*`z=!&|(+0Od%SSRuZd8XNoH@d`zGc}*$+jax7I&j*LyusjGiUImrFp0nGE-MoA zZTvN4d=@n&tf1n>RwLmT*#A}ZM^-U?(?rT1JnwCmcc4=Vb&XG7fs$Wh;0Q}-3> zIb}iS=O<@B^8#aFF41ZW3?Dt!dErhnt>KQMoa6UCN>*@Q{eqFmG?Aek4s@gmnGAbOgZTPf!qKFFjMBuKyFbM^MXjECc3|z@3LXxcbXwwa(1sxU=p2kF<&vu0 zJ};OX&njE87W}XIN#or3g#AIXw%QAODM7|EbVTnhvGI|gGKoWVuu*(xET<0f;$ieF zR6L|eg5iA9H4n&@0|hDWlPSO{uy<$%=AQHHLF}! z2ofm(QzWZWo=sVp2P36hQkbSnxg$n|E+KY)m?&D4P~*T&IMkP<8Hjq0^fSUD!Z!ew zcI0_5An`be0GYoPhJUcadf|wv6wiq`N4Qst8ZXvRb*>Cy5wVK->9s^7HV27E_`X~a z8p>^gw*+Zx7+~L4Wpq)9DWQmb6^K-n3=>HHDx-&fQV{>HsjaU)#*Sb?lnGPMpDuML z)>na9Xg1@xnIziLl%&`s*0!CAdH%ZX_Oui3KvbOVXdkhL8GDR1X{A|;j>?Dz1}#Py zabrlS^Kkt;He`a!g5rj|J^pOTabrq@NSk#q({eIyL^|@o4sanf(lknL|7V)na%Qd@ zu>_Qd1ZMa-tC2*Z*}kUpu8tBd@9jJiW5Eu2qnbxS!N!G92?S_s z;P3o8HK)g~@5NJ({rod6dB@nc{a24)Tr07*q1GM-pma4UN9U=M@P96=j}d2lK@3#cPXgV0I@F|c>; zDUYuw~gIj4%&qdkAapz-VTd|uYkaY5pvgMN30D9CM`;y z40LC!0o*%SQVP+PEM%JbWi(p^l7lvFi1ot*t@14fK7j5d1TK}<@hM>1RVrUcSCqq9 zX;r+*$>^Rt+DO{kUWa|$ovQ@A7rk34NP-Cc&fY z!f?-d6*J(7=TK8KMk)fw><=MceUv)RAZU1kb#jXUll?!x+S9|%SC~L<7#!M~%{{I9 zu`Lv7YX(uFz+NjUrYN>JWtSk%q+4mj;lBJ34muHo#MoB#XxwL=@OZmCqYOlK)-NPP zdLNqOM3XbDFL5OdfkQ4D>G*O|(i)TU4Z6?7qf)XVZf#FubEtBvd3i2i{gX<14RLu9 zpEHe}9^h!!3Jk?FD8Du8+}#>*YLQ-jBo{{hY$4fGwNv$_(evLJ8QO9z&8qmGbEWP zJ!|%XaRu0|rlC~9!bBT}8J7~6?(NKQ_La*jOCYV4?B=)c@tb8tQm|T}n4Cp(`kTLf zNy%O7Bx=GLln3*Mn<{=TDBY68)t(NdWr=Q*rUP&3o!v7~0==QsL$~0<{K8eD5S&EW z72xOn10y=8zf?F3QEq_0jvTeq-$uWK$&o)LofFUP=qzBog~1x-sW@Zq)Q1$&`_>pV zLl7c5LL7=2H4RIcLBK||f^+`f>Fkl@03tyVJmpz+?niMDP2#5LhtiS}&t?DfWI}+5 z+NE)ldIuDG1mDopxOj0n%$SajfdpFS?=9w#OHWs3!8{v?&o31t>oY*`SNT48*-B1< zTs#~MTrq{)Y1i>2p#~5hRuKtwsQwv2fWxvns5EpUDEblcQKH|W>8p z^UbQ?l01(#J9})|GZ~XM>cV+foDI2()0We8hR?`uhG^zyok3MmOT)ICvQnXseZi(a zFnQ@a=s7kMTtNK?WF3*>(q)py>B})rp5H0v;!zbnhmU>*?AG+wF_c57#hJ}8t*N; z-Zt}i2j%QeEGR&|cEa`;21*D9NL(SK;_dFO2Kacv-&^+>RQHCAgI=zdqPx=~GIdo1 zqKB8JF{Rw}wbY8UU5)&PNtTv#O6Rjw)OBcRhBvcz zCxY~jB?G;;4PC()PnTcXaq>do?+|L7)_)6JVtU<2uYij0{sbeZBV=1brE;!dCP+yV){$qOgF)P?;v8Fjf6IXnRrYKTSC4e#-D}8b6=o* zZJjYlvS{w|8%!h$7_B_l0EOfrPnFc)NSZ+{fp(gih9&lON&Q> zkq*xt%lxtEBpGWhEpB@kk8%WA(F<}P>+8X-kpn$yMJ5zPyrVOVR_Zo3rHVuTlcK?K zV@DNb49yQJ*wqWokpm3d7wi#vFVvFRizJaCdOF!qhL*#0Kc34#ooR>&8dKm87L;jj z%mfP^Of;#2u`ybHZY(HSIS&dcCJR@NJoMqWZ#Le%JI*=T-%kFCTp)z2q=;_mzAx`@ zphdV9^0lb%F($y@#|lc3M9_h)W>|gk>imEY85N!6SEJ{^wEdSmCFZseltL8aKTG*n zxNUe6ogCGu60JXVX3zzFd_X?z>J_P7=s8ov(@Qi_w!ZD!o9Zd8nsLq5+06y86(w1; zm@TU(aVm{|q*5gESK*uwQUQuRHhIQO)rxyUHEC-_E?__C4nE zP4cXZop07xuk?(zG2i$`IY2YK?V@`Vn^v9j2yPZyICxX+?7f) zc++kwA^#Etpgwt2U)zud0W4V2DPM}EEBFecd^pt(cQ1a^<(|yjNIoGKCLKCdjPVc@sP@; zCxssBe|H}|;mS}s4f9Ub@kj}xO4dQuRUeFU(?nM^n_cnviy<+^gwSNo9pw}rFvUy8 zqN}Py1oA~1>X&%g)M7R&7s#DQ8}yf7zqDC<7V~p5&-HKi!FT8%|02C)y1#cw=oq(r zC}QkJn4Pygp@CVyT^U)`z{qMJ%d~bCjdv;|h5GuTx0Xs8ZwzN`aze0L9LDf^{=PW1FNq1EBch>PB8#8Jk}x6e*_9eJJ|=EJ`D* zE{ek)mSb25zPlIzh)E+{$RQzK9e!4moPjxB9&>5|i`TqIrs<($ow_8^CE%0u z3J^KLMtBeQydDER8#W(EUlXqApC~Uw<6C??SqO^jcaR|^kVg>iSSOu$VY?XvTkFB- zh{+(B6%89KZ?!u5rKiSgdLl-v|Sh9Nha&99{LT-Y{gP52z6RcM^eoD=TpR9U^H}kYNz{_v&>`(G< z8s<^>*sC{leMCRDN|9E4;GNA({trx^;$SeKnLxm%)PT$O045**!U?evpTrV+;w-UZ z9jP*hh_Qfb2oWbLsnCG>JnziO%Q{Up7+bQV$G;N?w!mkbbusx{Btc`d^#l`?OnYT` z#Tog4;%kpWmz|F^76r?s!HmKg>qJHJ7gZj=URrk@NgEWjF#ndqpLpoh4CS--0NLY# z=efQ~oXb@M29%lE->IR2nu+)|%d^5e;x^Ia#hCR?BAXs z&?sAY?|8JE!pxVcvtxZkyS6D++077ppAX8PvVs*J$nIp#7pCH`!2snQ)3>y%O?lgS zR())+fS7S7Jn=vxg5+|X1B5B<)IYBt{j0||4^mKJNliAgT})gr4| zxMDn(o+QlQ9>NTn=NZ5jH$$cb=HhWws(LN@mI078B0;1`1lod^t0)aqN479dH19&k z}#(Md4NN3Q&j;!zBz*>B1U+CR=3 zJl8lfqIlvHEG!HzrA$^8)qDb%t+Py!8m{+Xf|*Li+AjnWi@M4{dqTa(2Xi3`g#2#6 zh0~d;G}QHUw%JO9W}^NZ=$R)zuXBQqh!$xF<3D&azSdCY5GNVISg&s|u$I=R1d zG1HHr<+|#Gk-)nk48%aBg8C%V+==g-e$oeck(j86o>y&&QoVpr5#^(S1ZG_s;I$!< z%{=XTM0#wyBcN3!17)%D1YQtv4xIyayt)0P>9kV`y ?!k9-P<6;|0%l4*@ilq4T zJP55xgPunH{81d3DWzt+y%~P@$y~B;iywb2u7?KU>>Zdzv2NUxcq?K+PIf2tr=hiA z!oAiVK#a!)l^k9z7Q~UP$_SqsBoB>d)nmRJMipvE`{&6;tg}8c-&7fSsktjmCWUPC zI}d;_irh~q$e=nUo{Os<9PS6yuLU^sy{wD{)v4TZuu|GtWl@md^4$q(L?-Sq}@?`NT z)8)C9HN2J|ga%#t&I^>543>NWAYXmHr*1bCj3{D7&dIZC(*syQYD{#HopuuOwL5NF z#Wf03;mcWtQ8}|Dw0~N3;Ry~Q{TfERV!R}>w?IDSQK;;FO_FHS{Z8xiU{bFiWNpje zF0tMiAXH%Me%0F1(6iEqyvh$G2Nw#nV;*{x<|-WI!)dYkq+Oj9i++gwhu!*QT45^1 zLAg|0&-1;GfccsnX6}SMe))9bVwq}?+)wS~53JwVKSt5mHE~S0J@c6hQ-ZPY3tA-mw~oZ0g3u))&Q#yP397KURMxV(XyKse zBCCZ#xoYJHs$5NtE%|fj!$EA`PA4KGz8o2^c}oPnh{?znBy4y%b8xn>^|+)zwR%(pf{x#3cFirm!>&|+1Nv1a?-recgH^zI1% zKHh($akU)E!^Eep3~%^ltFWjSXhPXQg+uPqvUqN!y1w~l-nS_NOQ%UT26ePHd6}}1 zGqH_hWDC08IRo`^tgn*-+#mV?473R*F(saV)Ab>lT$Yg54a*JM|5As9u^%F-kP@uH z9coR5USe27#m~@2w@p=fwJziqa7bNO#9l}(OYZVPY>AL&-xr_osJHx#l;x0(gVeDY zEK;3ABc#`x4y)TU3LW*sZOCEN>@n-jGI5Mj89^n32|R=ZPF(|4<_UKe$t>o~xCFHj zLh>RUQAx+C>*|`c1w9|CR@`%FwNeS8r5B=V<}>3%trV@V@&zwp1+WT*)`lBon;S9I zJk-wg41)4|90;U@kd0V5f~H)-P*%gv<$5K0p123i6g~i{sLB57aNg>o0v0Dech#Pv zuJlLXU`1c*%rVuoZcll`xJbB<4HjH?Pd7}r=52XA;bnQENL7xGV3qE!<*beJu6`XE zmMeiZ5GGR52=Pavqau1+m1?^`jO3{I$?Lzx=ei+wm$fGY8 zrY5pK zN~T#5j3SMyV67-hf-+4^X&`j}M`SPx%AOaYwQhlQj%#@OUV6*NV{{kZ|GkqV)4l$b zmrH#%9AAlD6wwitYd$mK$!B~ z|I^u7KteP2SQMFcEj5b2zxySrOJVhDj5m|^G=L6lNLIt2*<5s^|-0i^^35a})j zrQ7cg`ULWP>-*k!7He_u|DJR9KKtym?_FzV{q96zJMQDRVbZ|1n_Pr#WC+{JWbwB` zbk9WQ2TjY@q6){I{YlT8WfwgjnuADWRV98blB%qTXs#wGd5Ehfu=)|Dxi;T_&M(HC zdW-ReDTerK5PZz!CtK{vi+d+*hiku@vA??4pg}#hAH>#2xvQ(k$hlomv6qSo<7Nq$ z%TD^aBSc@`p~-Rijr(Qbi=2g4$sCRh_S~+;zNG>c2A4Ti!nz&(o|SZKhE%VrB>pMK z`+%uhN4R!2XmdaP zI&*Z_g$=RC+t$?Y%t!8S&a$s;J#N^@`*y3xN&ttcwXdj%01?Z`F+YB3-Kf9#ZM3#* z%v%GJ0H<|Hzqp6wlX`2zUr2wN{9#(a%?*;f{jIMPmPP&Pb1x}_LNoHug!LSxnXj>R zrM{>BdZxvABBLzQU2~S^YbMU6w|2aI!(+?;o_V%cPWH0agcDn}_R?723?+TYOE4enMw;_iPtoQyq|-e^CioDy)-0tMQB;_!cC)`H z+5Nuj`L^PnL8I2q>&Amb-}&Fs$*I6;gNrnFY0byR-k8r`P6WxyT`7P%YEUy0-jxe5 zrgdy1C2t`Aq-m)V_~mA&x#I2Bnd}b|EnBu%f(IYw(%DO<6sBdtxz_z;+JbU|_467U z?k&o)=C4ZB!<43m8)z-pCju!+UXHub z6erX?@|aGH*eN_OV3to?E=tO3sPxzH?Dr9!Kuj}aO&uLlJZPga(D;92% z71D5AcB3&}R2mvlBuRK~FsV2hx*Tk47X8^FX!UNuwj?3&jsB?XXEiFtPwy7krbyLw z`qn*1>NLy)d+#!FQa0?}bS&*?Hx8naH+m~f@%59Eiut%w4&BQx4$f8*>wnHBAVn0u(OYzK7wF z;%uf!)kO>pb(-{co-z`$?d3GDCCud_rk#nV-qEc!Ncoy~w;)DRwT~_C(v>DHwXHRX zhdA}+)?074Zne+#Rjt2>4$4$fXC*dd;!0SEtc}Yh399TE1`EWq?>@((kgUK9&{8MP zS9gr+v^~7YtM5+`2x-P{;Sv-mi5fkmX0M&I8*UE z-SWY^=6+SBEhnik@mVUX5o59%D$bqPyj6(rw{os2q=UPku{{Y8954#avHHZfy+vn~XfwwGYqa$JTN_5RBvrrCn1x&%0Vt z*`2h)mVSwCZU4k)55F4{2ld2q-P9k?YKqcm3CTX{^y^9{xEkgXHQA4OmmGO0I3A#gWW%FkC!(K^@%$RSd`DX?hlkleJZrr-kmG5@@D<4oCq>U?N z5UM+r9}sphtJP`|jEIr4=85_#e&0>>8Y$Z69&vw5B|xq?cUA@iPDDJe=hsCiyE_cq(JS~fvw&q@}I=6vkWAeh03qG;c#2&ym|x1cXZ7Hq)9-ba?HVP; zW2Oux@=8&EW5UYfCT1p&AJ5{T1GU%tN?*#;_}mxlGUmUjq}6aDjOw}D#mxv~o=vmR z9!E+pFOA`LgR&FN%uKCU#CS?lPqb0aoV^tlw|k#uk^jv5TBQW6n2Lt4fp_W6$3v#Y zGCXM1%SpPJmPtuTSGv6{8S`xC9?CYK4XJAn+G`k8rKgnj>?|1JwcFp>cXK4V2$#&_ zM)@NKYzVddU#_0eq2n6X;W645--#=rXnkl(O7k^&p(vXy$D4UV2}|P5WXwWe!_{!* zp&XP7Nmg>DslDH*B<~?M`HG4{&A9>)Yr5%qQ%BSzuQqvAZYy(+3{bFfwY?oj z<-LAl%Wc%7D{Lhpx$50f=fUMg6XE=VzWn`Vt*7_qyR)*Ms93w-=MOt~x^PZD#&Uv^ z<+hmVeF&~O?4h6VDBC4@0%OAR#s&I+9w4W?DBfj6X((6M093s52MPTc*`ShVX z_<9aK)kqtw1zq?=Q2h0_8kV>MR1szbxr1iq#g9 z`HZ(~6g+FJH)VueEaudwZe@a9wzkLlx7xCb2v1f~(QBmq^aJ}`dYxbzg6u6!|0zRf zYAx-~5G0FbnUoKGdI6@J#4{OiP>@s0O~!erCm(L6={3mvw$0v@LOIMSfvs6EIdc+= z4Q+}Q0Dk`IEq`e|oz=#~YoX0o$;I|_0z)`dR>OlddsJDCZn*4Qsu|LNTTb3iL5x)f zr|~+$;pA&3!<>r|3Sab~*;|uu%oss)xBWYQ@>oQGt9BNj?$SEde)1R8zXuy=Xt7%G zlrUGyymdtpE^83bROe<)QBu93nwn8`UrYjPx-1WT8^+S)ORV<@jBJ?;xyzGNRseX@I}G{TYwd#|h>dR+J|=TVTrwW>z50Gm@{G=}m3lp{1~r6I_iL zChTwUTEJ@4?WCMt4CCC?87RxS0@BXjR3^-9IKO9Nv^+idkq{isX{z9rcOoVb`JvHi z^qoN;fA=k-D=R$f)U&pJBab#);JF-B##>GGKf67MUz4VHxc0UB7>6!?b4=cxRWfuX zWKOx*9bWcIGXB|K(^bcVOX;iCs=86gFAf^dvDeT}hA;Y;uS_o_wpAlGIg-yB;^0Qn zjB2yD3OGoZh8R*w<*{oz<5WZO+?BzDca$9JPo4^G@CPl}zN-EBO`u>dS31J;Y&PO+ z&>hqELVzx!KzdDjZ8Z~oKVKuhlYdt%s0`z&OrF%y!{Weyjz_EVY`~D)2%mey zkRSs?j~l<~fzuh)%jEZ_x9LWrD?buzf2ql!TahF!hc3tzle@~Sk3@LHe5OfSnVICT zPW5RO{<0<@dX>g!^y_)nf=OLT(52ZtqL8AG4dm{ROn8~7cIcCD=+H=MHuTY6W%4v; zGl5$^Lu;45CzbZ`;?C;F#d&#e)c3`{xzTn6RC+8UfAuA z5{Sx#dl<10jc=Tcuw6G@-LV3J8r!8JI@UyDx?$#BdLEe|MVY;ew=JVz@nKG_J|IuY zanOPhN7}R%6OpSo{v=>W8M-d+ zFm=(h^Q*y@&!*xP9@~pewp(U*AC5lH{jT}8S^4Ycv=(Tev^1x#5h*PY-bQw1)@U;i z4*%dUjVl(g%nHScyQS8QBdJ^e0~Q!D?)8C7-3!ZgEt+;jHOTGZuWX_ee;r|mZ``bV&mh zxq+`2>1i)GB<__=EZ3bu&Q!*cP@sa>rX=7$M_i{GSx|GzchytOE?lzrbyhdH{_1-|d&XJn@BfUyz#87C>MJr;?AR7pQp^zH9ibGtdjf! zq0N{4Rv+KL*gtqx2wD7k_flw4i}EFrxIMe-T*c>x{00Vy2q>X%c=0L0B5y@Lqd@&oyx)4TPdoG! zGjX$7KAfb6Z_Bbh zeX#NhMG;)*uc&G8V3WWS5`LMzImNMR>)qR%_7B82WHGI}95zg6pv=q|Dbc%^CQoFI z%eyVuy}U*^p*1lSu=IxLsm(NP`bu~5Gs0MY&{Kag3s%LLhFA%Pwo-);f|dHUiscvW ziPL3?E@+gfY`D=`>>8C@m+lcX?$)GItH#{6s4QEFz!gKMJKG<}R_yyX<4?~&SRc1OPaO5kJYyur)( z9fLN6d-~#Z;@6X;Is(4dhKnR*mk)w0PTDok;!Y}j46J7() z?^f^k3E35GcTAoxbfiQ{e<4toWJ-%r)dhKcRPa?_+8XPhNEWJ0xtT{N%Q$4;`Q4gTa$ExmeI5R?LOk10U)hJHv4BCf=NsH@na>ey?jX>u2GThec#I<>NWxb*_E8^Tp?la%L zE5iuNZM%1%osaQ!P`}^G=-#QE{-gFT-2JlPSW-(Rl#)~7Ga zet##0RWH_PIqP(Aj7IlsjD+JJa!k@_FjcL#SiJ-b)eI5WFy_ZUP^>da>C88vPYX}gz^yh=GVR1bu<8{I>RBhkXG;BWxI=t-hW?RU=vLO(3 zpRa_BoT*)4z9|7`nM@zewIk+s1BGSM2%QU#rFTB??=3_6;XoaspcIcwc5 z>1T%&HA_C$oFXw5Clm0R>ro(%+u1A8C_Xdjkznonb0IUB{(YZZ+9mz`8_m&a;~{xV zV(nS{n92jp{)W=z#z*D5g(`NJK=l`L;?k7S9K$0o98w!*J>EmmlJvg9`wx?FH*U$t z=bs$*mpIL1ogHSUQyS0SrQTWe-Ta{P-gjr2;Z%mE+p+r5;c0Vp{4e9`>rBO#0xi1k z#OCkaWm%tAQLz8`=trbo{EzvDpsO94k-e;X+Jy9{PBtYvdq~ig_OhyX+6*kR7%QmK zg5gROg=b!8?!7;qCxYU8l}})k)n`FQme0o(b{dv!YKL5>AYE%V*0y z%edFg?kHgFslb`xz9*E)LUq|H-z5mOox2cvhd(SZ<;`#u7O4I6Y7RctZ=X_zWMgBR z2qk;3>Ya>`T`!RD)!w*b5~A&ar0QuYrrFM}*`)}R5V=`RpPm#sUX;#Wsm&MzS0N9L zXi4VViP(pmWzPqNAp+}`A3oSkp`Iz{>3rop-Z(5L=9UGP_~i#TNj@4blFNlL zin}wSd<}NjD&CGgx1nDM>y-GF{yw{}}(Fdwg~qkXh^->8r|IDG)OP#~2y7vD&y zS?{#9%EO~$Fn+aQ!tF|~f?CCo7vJtA-?qunm3sf&Upw*{jV@#w8C3^DQxBbBm7i6P z3e$=f++(wIQW#*lwix9&zR`ML*kJ+uE>4p5zR}*Ce-~#cg}K@5vfx`}AE-^+7N2(k zuV;I5t@lP`7olTgIjg#8e7asSF*zkU`jq9g&s#E`!m@iLhRJ#|HHQ9=aFV@Gt@*uP;S9)*H*DO@MyOnEZb%&pBnK*sDHjIdfLEQOLDG|F)VfvHveLM3` z`Wz85*zuMEld)<3{1^ggCXMzkD0t3dgZ-9e9v3$!2haNToDIpG#;nS7?0H-n@rx|y ztX3Yxe^5z@JU1gK-$Q{``v%V9qU9RtsgY^#w{=bzTR-XY z%)Jm+Tj%3V`JjUPh^o7>Z^5j?p*ydd)`;6l^r6j~lxytDsMqhg7+L#vmPI*=KUaJ5 zY+t|OQ#l&VhtilYZNm}Y(+VQb@5g*&^3jRmv)%|5p=BdzLV6D?$63(1_=rr7f6yXG zaw8gY*r9#7@x!8_KJ1(S1T}J*L@07Xrtx*z+@~rvezX>ts7mOzwT0z)Kgs7qg3X% zSVee7UypWc{wVHR@^NL)UW9#W%Kbu>ujkZh0n-T8cPAptVLU!M`}FfBw@z|`KgvGJ z;e9l`BG{Yxx(KbD#tAdRewepyU=1O^O^~>Pn+$*_R47vp7u&sY>3lWKJ2OjZIiVuC zpuplcE;o*2iNgrxy-~l#4`pG{jCZvf+Uu&1iR*1S*l-Y~D&tYrnkU|lrlv@Jz)#TP zr@#5;X+gH-7X$k8?#`kWc}QjBLNe#PR%qBNf>!3Vj$;YG2NAzt9q`kckT!!*ubinW z-4A+oy zGRSwVkefe`;RjK$`OPqYr`qLLrp=#!*5?t&T_&Uq)f0DFdPTr7XMY`P#NC4 zhOOHQ)?UpalsF+P3h5n%sJ$t++Fk-<6P73g^jE7dyP3StT%@Qs3FCAmB4>R*T`OT2 zy4=MbBI`4^nQeXNTm3`g0RLsPEh{_DEjCnzHPcGF^;CP3)U`p`oZI6I%I+UY=#2e8 z{;X=G&W??;S4|1=>+42nERnVCHhFQIWOG~mxFe(U;#(W-#u#ILngQHtIMd_;tw7X% zWA8Ffv0!id1;-_t)zVo7-erMR5l0uF+NG7r>TarYv}ds7rs@kmo=)$3M*!2O=laJ1k)$lohPBE^Z3dqX(_TTM)}$DD+Z|z)bg$@aI4E+xYw<$k^{lh0p0N+rLAvM3ohs;}(#?Qa<*P>Mt=J);#J z@^y5)Of4+q8GO3iZFf$sP3C~#Je?tO*^;UI*__C8(HZ5q_}JBKzQrkaFjs4LhORfe z^Xh8H%Wo-(1M0CcX(gZ=UZ{z}M6R&zq_2G+sQE`6yvxO0azMMj`_F}QhBr4I+SVe< zJBFnW);AJ>7o&U`Tu4;kW_Zp`Yo-c)w|AU38|Tug_*n z=jK5pwqoyR0^xS88oHKaS|W8Hexv5Z?A>>`dp4f6mMb&PZ%|PT$>(oBAeUUQZN0JG zKCCxfWzfok8LZu1wig`Lp3&6Mr>6K^R-|VCdjF#Rnf|&lqqh}HWEC^U+s2P=>^6%} z{=Bx?HhY6PHfaMllRfz(@XF4F`FU5Dq>Xi_&9yXG*(e9PA-;xnIOgemV@_;ImBIA3 z9oBN~rLpHXSZ4njlY=pG0nd_q2c7TSN`1_OH(PG?r-Kn zLs4z_zJ;8{6xCgqvmA-y#iouGj&*AR9P{R#O0k|621Ry}l4Tq+H|G~dwR&Ip%~tvU zG+|8ek#77}mO9bj`;*3^#{WaCrDHm<{%Z>^8!rX*{3R+z&2nE7nMgdMqvRyMmUD`N zoG2EndoDtC1$!>ySr0p5(4Ig$142=LxMvP1B8UI+8XhQw_u$ttzBT>`-&61q9dw8p zIz0RL=y-1g|K}D^`1IVZFz#GH zasV#sf;fRaXNk76bau2ua)Ds@Sp%Y@Ed+*u!GxheJNPfj6|l|^<^tg(2eddmg#bN% zU&bJvQD}E0*3uehj|Jr4qyH`2I9Q(UEBc|oB$8tzb^ny-5t>= z{G<-^0GJgPXZ^Q&sQ)&5Lr=( zBf1a}*8lQH7?{$bU0|Q9JGwZ!|FP0XXC=&aBunsl^H<&aolu9XaHP?{t1wW(00W4_ zeEWC0;b-{QK)>=;&dS}&8EsD{aG1ED!;A*X?XO%!;Ku~c@YgiZwn&hG0T!u+b9V;V zX;=`MfR-x~C3Cnwpu^bx+Y~+sf0>fOxjUdSoLmC>jsQOm_^*evz5y&Oa3qHT(g(Pv zZl#Yj26;NVJAit+)i#klvnX zj4hTEC{>380huCi<&Fe#%8Nn-!3aSJK(hn(Fa&H0w9wX9Fy>dpIXhchp-@N+h*RIe z5eowTevirvGQ<<-&?pd;9}EM-MIgWI@Im+?AWkEsHAD_1#1H2OQpL&D3b;8Ttw0`s z_rUA_n!gt?0WzSx2$2CqvtJ*eV8P))lG%a&(ST*de~xItsvXmSg*c`G>2yp3Qu0tk z{bd6J+=c$spm-44AMFGM;lQ5%qc04f`hRL7z{>ui9hS`_8Ulg`uN`d%gCT@~E%`?~ zsL*j62mr`-w4ERXA#_|5g8r$&pu)%OLclP9Qg?Jb7!+|#6NCu;$J~VRx1%FIL%?8s z**cUR2 zk7$Cx4*GK~1z}J;(rj9&n%*{Mil;5jhqEV3Ypoiy#bkJf=WCANLP-d_CZ> z<2eq)0}B7}8U7!8PzVA)W&wdi6O&3uy3B|-o1CiojG85aKxc38&|FtCUq85^5|mLl2z0X;LIZ~y=R diff --git a/contrib/bind9/doc/arm/notes.xml b/contrib/bind9/doc/arm/notes.xml index 0e7d95fdd..72cebb286 100644 --- a/contrib/bind9/doc/arm/notes.xml +++ b/contrib/bind9/doc/arm/notes.xml @@ -1,4 +1,6 @@ - + +]> - - - - Introduction +

+ +
Introduction - This document summarizes changes since BIND 9.9.8: + This document summarizes changes since BIND 9.9.9: - BIND 9.9.8-P4 addresses the security issues described in - CVE-2016-1285 and CVE-2016-1286. + BIND 9.10.9-P3 addresses the security issue described in + CVE-2016-2776. - BIND 9.9.8-P3 addresses the security issue described in CVE-2015-8704. - It also fixes a serious regression in authoritative server selection - that was introduced in 9.9.8. + BIND 9.9.9-P2 addresses the security issue described in + CVE-2016-2775. - BIND 9.9.8-P2 addresses security issues described in CVE-2015-3193 - (OpenSSL), CVE-2015-8000 and CVE-2015-8461. + BIND 9.9.9-P1 addresses Windows installation issues and a race + condition in the rbt/rbtdb implementation resulting in named + exiting due to assertion failures being detected. - - BIND 9.9.8-P1 was incomplete and was withdrawn prior to publication. - - - - Download + +
+ +
Download The latest versions of BIND 9 software can always be found at - http://www.isc.org/downloads/. + http://www.isc.org/downloads/. There you will find additional information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems. - - - Security Fixes +
+ +
Security Fixes - The resolver could abort with an assertion failure due to - improper DNAME handling when parsing fetch reply - messages. This flaw is disclosed in CVE-2016-1286. [RT #41753] + It was possible to trigger a assertion when rendering a + message using a specially crafted request. This flaw is + disclosed in CVE-2016-2776. [RT #43139] - Malformed control messages can trigger assertions in named - and rndc. This flaw is disclosed in CVE-2016-1285. [RT - #41666] - - - - - Specific APL data could trigger an INSIST. This flaw - is disclosed in CVE-2015-8704. [RT #41396] - - - - - Named is potentially vulnerable to the OpenSSL vulnerability - described in CVE-2015-3193. + getrrsetbyname with a non absolute name could trigger an + infinite recursion bug in lwresd and named with lwres + configured if when combined with a search list entry the + resulting name is too long. This flaw is disclosed in + CVE-2016-2775. [RT #42694] + + +
+ +
New Features + - Incorrect reference counting could result in an INSIST - failure if a socket error occurred while performing a - lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945] + None. + +
+ +
Feature Changes + - Insufficient testing when parsing a message allowed - records with an incorrect class to be be accepted, - triggering a REQUIRE failure when those records - were subsequently cached. This flaw is disclosed - in CVE-2015-8000. [RT #40987] + None. - - - New Features +
+ +
Porting Changes - None + + None. + - - - Feature Changes +
+ +
Bug Fixes - - Updated the compiled in addresses for H.ROOT-SERVERS.NET. + + Windows installs were failing due to triggering UAC without + the installation binary being signed. - - - - Bug Fixes - - Authoritative servers that were marked as bogus (e.g. blackholed - in configuration or with invalid addresses) were being queried - anyway. [RT #41321] + A race condition in rbt/rbtdb was leading to INSISTs being + triggered. - - - End of Life +
+ +
End of Life - The BIND 9.9 (Extended Support Version) will be supported until + BIND 9.9 (Extended Support Version) will be supported until December, 2017. - https://www.isc.org/downloads/software-support-policy/ + https://www.isc.org/downloads/software-support-policy/ - - - Thank You +
+ +
Thank You Thank you to everyone who assisted us in making this release possible. If you would like to contribute to ISC to assist us in continuing to make quality open source software, please visit our donations page at - http://www.isc.org/donate/. + http://www.isc.org/donate/. - - +
+
diff --git a/contrib/bind9/doc/arm/noteversion.xml.in b/contrib/bind9/doc/arm/noteversion.xml.in new file mode 100644 index 000000000..e42aeb2b3 --- /dev/null +++ b/contrib/bind9/doc/arm/noteversion.xml.in @@ -0,0 +1,17 @@ + + +Release Notes for BIND Version @BIND9_VERSION@ diff --git a/contrib/bind9/doc/arm/pkcs11.xml b/contrib/bind9/doc/arm/pkcs11.xml index d5a841295..86a7305e3 100644 --- a/contrib/bind9/doc/arm/pkcs11.xml +++ b/contrib/bind9/doc/arm/pkcs11.xml @@ -1,8 +1,5 @@ -]> - + +
PKCS #11 (Cryptoki) support - - PKCS #11 (Cryptoki) support PKCS #11 (Public Key Cryptography Standard #11) defines a platform- independent API for the control of hardware security modules (HSMs) and other cryptographic support devices. @@ -28,8 +24,8 @@ cryptographic acceleration board, tested under Solaris x86, and the AEP Keyper network-attached key storage device, tested with Debian Linux, Solaris x86 and Windows Server 2003. - - Prerequisites +
Prerequisites + See the HSM vendor documentation for information about installing, initializing, testing and troubleshooting the HSM. @@ -60,7 +56,7 @@ function primarily as secure key storage devices, but lack hardware acceleration. These devices are highly secure, but are not necessarily any faster at cryptography than the - system CPU — often, they are slower. It is therefore + system CPU — often, they are slower. It is therefore most efficient to use them only for those cryptographic functions that require access to the secured private key, such as zone signing, and to use the system CPU for all @@ -71,15 +67,15 @@ The modified OpenSSL code is included in the BIND 9 release, in the form of a context diff against the latest versions of - OpenSSL. OpenSSL 0.9.8, 1.0.0, and 1.0.1 are supported; there are - separate diffs for each version. In the examples to follow, - we use OpenSSL 0.9.8, but the same methods work with OpenSSL - 1.0.0 and 1.0.1. + OpenSSL. OpenSSL 0.9.8, 1.0.0, 1.0.1 and 1.0.2 are supported; + there are separate diffs for each version. In the examples to + follow, we use OpenSSL 0.9.8, but the same methods work with + OpenSSL 1.0.0 through 1.0.2. - The latest OpenSSL versions at the time of the BIND release - are 0.9.8y, 1.0.0k and 1.0.1e. - ISC will provide an updated patch as new versions of OpenSSL + The OpenSSL patches as of this writing (January 2016) + support versions 0.9.8zh, 1.0.0t, 1.0.1q and 1.0.2f. + ISC will provide updated patches as new versions of OpenSSL are released. The version number in the following examples is expected to change. @@ -89,7 +85,7 @@ library. Obtain OpenSSL 0.9.8s: -$ wget http://www.openssl.org/source/openssl-0.9.8s.tar.gz +$ wget http://www.openssl.org/source/openssl-0.9.8s.tar.gz Extract the tarball: @@ -108,9 +104,9 @@ $ patch -p1 -d openssl-0.9.8s \ elsewhere on the system. In the following examples, we choose to install into "/opt/pkcs11/usr". We will use this location when we configure BIND 9. - +
Building OpenSSL for the AEP Keyper on Linux - Building OpenSSL for the AEP Keyper on Linux + The AEP Keyper is a highly secure key storage device, but does not provide hardware cryptographic acceleration. It can carry out cryptographic operations, but it is probably @@ -139,10 +135,10 @@ $ ./Configure linux-generic32 -m32 -pthread \ and "make test". If "make test" fails with "pthread_atfork() not found", you forgot to add the -pthread above. - - +
+
Building OpenSSL for the SCA 6000 on Solaris - Building OpenSSL for the SCA 6000 on Solaris + The SCA-6000 PKCS #11 provider is installed as a system library, libpkcs11. It is a true crypto accelerator, up to 4 times faster than any CPU, so the flavor shall be @@ -158,13 +154,13 @@ $ ./Configure solaris64-x86_64-cc \ (For a 32-bit build, use "solaris-x86-cc" and /usr/lib/libpkcs11.so.) - After configuring, run - make and + After configuring, run + make and make test. - - +
+
Building OpenSSL for SoftHSM - Building OpenSSL for SoftHSM + SoftHSM is a software library provided by the OpenDNSSEC project (http://www.opendnssec.org) which provides a PKCS#11 interface to a virtual HSM, implemented in the form of encrypted @@ -183,7 +179,7 @@ $ configure --prefix=/opt/pkcs11/usr $ make $ make install $ export SOFTHSM_CONF=/opt/pkcs11/softhsm.conf -$ echo "0:/opt/pkcs11/softhsm.db" > $SOFTHSM_CONF +$ echo "0:/opt/pkcs11/softhsm.db" > $SOFTHSM_CONF $ /opt/pkcs11/usr/bin/softhsm --init-token 0 --slot 0 --label softhsm SoftHSM can perform all cryptographic operations, but @@ -199,7 +195,7 @@ $ ./Configure linux-x86_64 -pthread \ After configuring, run "make" and "make test". - +
Once you have built OpenSSL, run "apps/openssl engine pkcs11" to confirm that PKCS #11 support was compiled in correctly. The output @@ -219,16 +215,16 @@ $ ./Configure linux-x86_64 -pthread \ [ available ]. If the output is correct, run "make install" which will install the - modified OpenSSL suite to + modified OpenSSL suite to /opt/pkcs11/usr. - - - Building BIND 9 with PKCS#11 +
+
Building BIND 9 with PKCS#11 + When building BIND 9, the location of the custom-built OpenSSL library must be specified via configure. - +
Configuring BIND 9 for Linux with the AEP Keyper - Configuring BIND 9 for Linux with the AEP Keyper + To link with the PKCS #11 provider, threads must be enabled in the BIND 9 build. The PKCS #11 library for the AEP Keyper is currently @@ -241,10 +237,10 @@ $ ./configure CC="gcc -m32" --enable-threads \ --with-openssl=/opt/pkcs11/usr \ --with-pkcs11=/opt/pkcs11/usr/lib/libpkcs11.so - - +
+
Configuring BIND 9 for Solaris with the SCA 6000 - Configuring BIND 9 for Solaris with the SCA 6000 + To link with the PKCS #11 provider, threads must be enabled in the BIND 9 build. @@ -259,32 +255,32 @@ $ ./configure CC="cc -xarch=amd64" --enable-threads \ incorrectly specified the path to OpenSSL (it should be the same as the --prefix argument to the OpenSSL Configure). - - +
+
Configuring BIND 9 for SoftHSM - Configuring BIND 9 for SoftHSM + $ cd ../bind9 $ ./configure --enable-threads \ --with-openssl=/opt/pkcs11/usr \ --with-pkcs11=/opt/pkcs11/usr/lib/libpkcs11.so - +
After configuring, run "make", "make test" and "make install". (Note: If "make test" fails in the "pkcs11" system test, you may have forgotten to set the SOFTHSM_CONF environment variable.) - - - PKCS #11 Tools +
+
PKCS #11 Tools + BIND 9 includes a minimal set of tools to operate the - HSM, including + HSM, including pkcs11-keygen to generate a new key pair - within the HSM, + within the HSM, pkcs11-list to list objects currently - available, and + available, and pkcs11-destroy to remove objects. In UNIX/Linux builds, these tools are built only if BIND 9 is configured with the --with-pkcs11 option. (NOTE: If @@ -293,9 +289,9 @@ $ ./configure --enable-threads \ provider will be left undefined. Use the -m option or the PKCS11_PROVIDER environment variable to specify the path to the provider.) - - - Using the HSM +
+
Using the HSM + First, we must set up the runtime environment so the OpenSSL and PKCS #11 libraries can be loaded: @@ -304,7 +300,7 @@ $ export LD_LIBRARY_PATH=/opt/pkcs11/usr/lib:${LD_LIBRARY_PATH}When operating an AEP Keyper, it is also necessary to specify the location of the "machine" file, which stores information about the Keyper for use by PKCS #11 provider - library. If the machine file is in + library. If the machine file is in /opt/Keyper/PKCS11Provider/machine, use: @@ -312,14 +308,14 @@ $ export KEYPER_LIBRARY_PATH=/opt/Keyper/PKCS11Provider These environment variables must be set whenever running - any tool that uses the HSM, including - pkcs11-keygen, - pkcs11-list, - pkcs11-destroy, - dnssec-keyfromlabel, - dnssec-signzone, + any tool that uses the HSM, including + pkcs11-keygen, + pkcs11-list, + pkcs11-destroy, + dnssec-keyfromlabel, + dnssec-signzone, dnssec-keygen(which will use the HSM for - random number generation), and + random number generation), and named. We can now create and use keys in the HSM. In this case, we will create a 2048 bit key and give it the label @@ -367,9 +363,9 @@ $ dnssec-keygen example.net rolled more frequently, if you wish, to compensate for a reduction in key security. Now you can sign the zone. (Note: If not using the -S - option to + option to dnssec-signzone, it will be necessary to add - the contents of both + the contents of both K*.key files to the zone master file before signing it.) @@ -381,35 +377,35 @@ Zone signing complete: Algorithm: NSEC3RSASHA1: ZSKs: 1, KSKs: 1 active, 0 revoked, 0 stand-by example.net.signed - - - Specifying the engine on the command line - The OpenSSL engine can be specified in - named and all of the BIND +
+
Specifying the engine on the command line + + The OpenSSL engine can be specified in + named and all of the BIND dnssec-* tools by using the "-E <engine>" command line option. If BIND 9 is built with the --with-pkcs11 option, this option defaults to "pkcs11". Specifying the engine will generally not be necessary unless for some reason you wish to use a different OpenSSL engine. - If you wish to disable use of the "pkcs11" engine — + If you wish to disable use of the "pkcs11" engine — for troubleshooting purposes, or because the HSM is unavailable - — set the engine to the empty string. For example: + — set the engine to the empty string. For example: $ dnssec-signzone -E '' -S example.net - This causes + This causes dnssec-signzone to run as if it were compiled without the --with-pkcs11 option. - - - Running named with automatic zone re-signing - If you want +
+
Running named with automatic zone re-signing + + If you want named to dynamically re-sign zones using HSM keys, and/or to to sign new records inserted via nsupdate, then named must have access to the HSM PIN. This can be accomplished by placing the PIN into the openssl.cnf file (in the above - examples, + examples, /opt/pkcs11/usr/ssl/openssl.cnf). The location of the openssl.cnf file can be overridden by setting the OPENSSL_CONF environment variable before running @@ -428,7 +424,7 @@ $ dnssec-signzone -E '' -S example.net without PIN entry. (The pkcs11-* tools access the HSM directly, not via OpenSSL, so a PIN will still be required to use them.) - - +
diff --git a/contrib/bind9/doc/arm/pkgversion.xml.in b/contrib/bind9/doc/arm/pkgversion.xml.in new file mode 100644 index 000000000..1329f53ad --- /dev/null +++ b/contrib/bind9/doc/arm/pkgversion.xml.in @@ -0,0 +1,17 @@ + + + This version of the manual corresponds to BIND version @PACKAGE_VERSION@. diff --git a/contrib/bind9/doc/arm/releaseinfo.xml.in b/contrib/bind9/doc/arm/releaseinfo.xml.in new file mode 100644 index 000000000..a3bbd20a9 --- /dev/null +++ b/contrib/bind9/doc/arm/releaseinfo.xml.in @@ -0,0 +1,17 @@ + + +BIND Version @BIND9_VERSION@ diff --git a/contrib/bind9/doc/misc/options b/contrib/bind9/doc/misc/options index 66df0bd60..f23568cda 100644 --- a/contrib/bind9/doc/misc/options +++ b/contrib/bind9/doc/misc/options @@ -32,7 +32,7 @@ logging { print-time ; severity ; stderr; - syslog ; + syslog [ ]; }; }; @@ -41,7 +41,7 @@ lwres { [ port ]; ... }; ndots ; search { ; ... }; - view ; + view [ ]; }; managed-keys { @@ -92,14 +92,14 @@ options { check-wildcard ; cleaning-interval ; clients-per-query ; - coresize ; - datasize ; + coresize ( unlimited | default | ); + datasize ( unlimited | default | ); deallocate-on-exit ; // obsolete deny-answer-addresses { ; ... } [ except-from { ; ... } ]; deny-answer-aliases { ; ... } [ except-from { ; ... } ]; - dialup ; + dialup ( notify | notify-passive | refresh | passive | ); directory ; disable-algorithms { ; ... }; disable-empty-zone ; @@ -132,9 +132,13 @@ options { empty-zones-enable ; fake-iquery ; // obsolete fetch-glue ; // obsolete - files ; + fetch-quota-params + ; // not configured + fetches-per-server [ ( drop | fail ) ]; // not configured + fetches-per-zone [ ( drop | fail ) ]; // not configured + files ( unlimited | default | ); filter-aaaa { ; ... }; // not configured - filter-aaaa-on-v4 ; // not configured + filter-aaaa-on-v4 ( break-dnssec | ); // not configured flush-zones-on-shutdown ; forward ( first | only ); forwarders [ port ] { ( | ) @@ -146,7 +150,7 @@ options { hostname ( | none ); inline-signing ; interface-interval ; - ixfr-from-differences ; + ixfr-from-differences ( master | slave | ); key-directory ; lame-ttl ; listen-on [ port ] { ; ... }; @@ -159,7 +163,7 @@ options { max-cache-size ; max-cache-ttl ; max-clients-per-query ; - max-ixfr-log-size ; // obsolete + max-ixfr-log-size ( unlimited | default | ); // obsolete max-journal-size ; max-ncache-ttl ; max-recursion-depth ; @@ -182,7 +186,7 @@ options { multiple-cnames ; // obsolete named-xfer ; // obsolete no-case-compress { ; ... }; - notify ; + notify ( explicit | master-only | ); notify-delay ; notify-source ( | * ) [ port ( | * ) ]; notify-source-v6 ( | * ) [ port ( | * ) ]; @@ -227,7 +231,7 @@ options { sig-signing-type ; sig-validity-interval [ ]; sortlist { ; ... }; - stacksize ; + stacksize ( unlimited | default | ); statistics-file ; statistics-interval ; // not yet implemented suppress-initial-notify ; // not yet implemented @@ -249,14 +253,14 @@ options { update-check-ksk ; use-alt-transfer-source ; use-id-pool ; // obsolete - use-ixfr ; + use-ixfr ; // obsolete use-queryport-pool ; // obsolete use-v4-udp-ports { ; ... }; use-v6-udp-ports { ; ... }; version ( | none ); zero-no-soa-ttl ; zero-no-soa-ttl-cache ; - zone-statistics ; + zone-statistics ( full | terse | none | ); }; server { @@ -285,7 +289,7 @@ statistics-channels { trusted-keys { ; ... }; -view { +view [ ] { acache-cleaning-interval ; acache-enable ; additional-from-auth ; @@ -327,7 +331,7 @@ view { except-from { ; ... } ]; deny-answer-aliases { ; ... } [ except-from { ; ... } ]; - dialup ; + dialup ( notify | notify-passive | refresh | passive | ); disable-algorithms { ; ... }; disable-empty-zone ; dlz { @@ -360,13 +364,17 @@ view { empty-server ; empty-zones-enable ; fetch-glue ; // obsolete + fetch-quota-params + ; // not configured + fetches-per-server [ ( drop | fail ) ]; // not configured + fetches-per-zone [ ( drop | fail ) ]; // not configured filter-aaaa { ; ... }; // not configured - filter-aaaa-on-v4 ; // not configured + filter-aaaa-on-v4 ( break-dnssec | ); // not configured forward ( first | only ); forwarders [ port ] { ( | ) [ port ]; ... }; inline-signing ; - ixfr-from-differences ; + ixfr-from-differences ( master | slave | ); key { algorithm ; secret ; @@ -384,7 +392,7 @@ view { max-cache-size ; max-cache-ttl ; max-clients-per-query ; - max-ixfr-log-size ; // obsolete + max-ixfr-log-size ( unlimited | default | ); // obsolete max-journal-size ; max-ncache-ttl ; max-recursion-depth ; @@ -402,7 +410,7 @@ view { minimal-responses ; multi-master ; no-case-compress { ; ... }; - notify ; + notify ( explicit | master-only | ); notify-delay ; notify-source ( | * ) [ port ( | * ) ]; notify-source-v6 ( | * ) [ port ( | * ) ]; @@ -468,7 +476,7 @@ view { use-queryport-pool ; // obsolete zero-no-soa-ttl ; zero-no-soa-ttl-cache ; - zone { + zone [ ] { allow-notify { ; ... }; allow-query { ; ... }; allow-query-on { ; ... }; @@ -494,7 +502,8 @@ view { check-wildcard ; database ; delegation-only ; - dialup ; + dialup ( notify | notify-passive | refresh | passive | + ); dnssec-dnskey-kskonly ; dnssec-loadkeys-interval ; dnssec-secure-to-insecure ; @@ -514,7 +523,8 @@ view { masters [ port ] { ( | [ port ] | [ port ] ) [ key ]; ... }; - max-ixfr-log-size ; // obsolete + max-ixfr-log-size ( unlimited | default | + ); // obsolete max-journal-size ; max-refresh-time ; max-retry-time ; @@ -525,7 +535,7 @@ view { min-refresh-time ; min-retry-time ; multi-master ; - notify ; + notify ( explicit | master-only | ); notify-delay ; notify-source ( | * ) [ port ( | * ) ]; @@ -559,12 +569,12 @@ view { ] ; ... }; use-alt-transfer-source ; zero-no-soa-ttl ; - zone-statistics ; + zone-statistics ( full | terse | none | ); }; - zone-statistics ; + zone-statistics ( full | terse | none | ); }; -zone { +zone [ ] { allow-notify { ; ... }; allow-query { ; ... }; allow-query-on { ; ... }; @@ -589,7 +599,7 @@ zone { check-wildcard ; database ; delegation-only ; - dialup ; + dialup ( notify | notify-passive | refresh | passive | ); dnssec-dnskey-kskonly ; dnssec-loadkeys-interval ; dnssec-secure-to-insecure ; @@ -609,7 +619,7 @@ zone { masters [ port ] { ( | [ port ] | [ port ] ) [ key ]; ... }; - max-ixfr-log-size ; // obsolete + max-ixfr-log-size ( unlimited | default | ); // obsolete max-journal-size ; max-refresh-time ; max-retry-time ; @@ -620,7 +630,7 @@ zone { min-refresh-time ; min-retry-time ; multi-master ; - notify ; + notify ( explicit | master-only | ); notify-delay ; notify-source ( | * ) [ port ( | * ) ]; notify-source-v6 ( | * ) [ port ( | * ) ]; @@ -648,6 +658,6 @@ zone { | zonesub | external ) [ ] ; ... }; use-alt-transfer-source ; zero-no-soa-ttl ; - zone-statistics ; + zone-statistics ( full | terse | none | ); }; diff --git a/contrib/bind9/doc/misc/rfc-compliance b/contrib/bind9/doc/misc/rfc-compliance index 18e6e8ba2..766cd23fa 100644 --- a/contrib/bind9/doc/misc/rfc-compliance +++ b/contrib/bind9/doc/misc/rfc-compliance @@ -85,7 +85,7 @@ or Best Current Practice (BCP) documents. RFC6891 RFC7043 RFC7314 - RFC7314 + RFC7477 The following DNS related RFC have been obsoleted diff --git a/contrib/bind9/isc-config.sh.in b/contrib/bind9/isc-config.sh.in index 04a9e5c6f..056c4875a 100644 --- a/contrib/bind9/isc-config.sh.in +++ b/contrib/bind9/isc-config.sh.in @@ -74,7 +74,7 @@ while test $# -gt 0; do echo_exec_prefix=true ;; --version) - echo @BIND9_VERSION@ + echo VERSION=@BIND9_VERSION@ exit 0 ;; --cflags) diff --git a/contrib/bind9/lib/bind9/Makefile.in b/contrib/bind9/lib/bind9/Makefile.in index e9e65daa9..32481c40c 100644 --- a/contrib/bind9/lib/bind9/Makefile.in +++ b/contrib/bind9/lib/bind9/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2007, 2009, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007, 2009, 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @LIBBIND9_API@ diff --git a/contrib/bind9/lib/bind9/api b/contrib/bind9/lib/bind9/api index bd19d6da5..b4f3c8dc4 100644 --- a/contrib/bind9/lib/bind9/api +++ b/contrib/bind9/lib/bind9/api @@ -5,5 +5,5 @@ # 9.9: 90-109 # 9.9-sub: 130-139 LIBINTERFACE = 90 -LIBREVISION = 14 +LIBREVISION = 15 LIBAGE = 0 diff --git a/contrib/bind9/lib/bind9/check.c b/contrib/bind9/lib/bind9/check.c index bc7aabe2e..cbfa8301e 100644 --- a/contrib/bind9/lib/bind9/check.c +++ b/contrib/bind9/lib/bind9/check.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2001-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -1292,6 +1292,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, dns_name_t *zname = NULL; isc_buffer_t b; isc_boolean_t root = ISC_FALSE; + isc_boolean_t rfc1918 = ISC_FALSE; + isc_boolean_t ula = ISC_FALSE; const cfg_listelt_t *element; isc_boolean_t ddns = ISC_FALSE; @@ -1461,6 +1463,10 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, result = tresult; if (dns_name_equal(zname, dns_rootname)) root = ISC_TRUE; + else if (dns_name_isrfc1918(zname)) + rfc1918 = ISC_TRUE; + else if (dns_name_isula(zname)) + ula = ISC_TRUE; } /* @@ -1730,6 +1736,32 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, if (check_forward(zoptions, obj, logctx) != ISC_R_SUCCESS) result = ISC_R_FAILURE; + /* + * Check that a RFC 1918 / ULA reverse zone is not forward first + * unless explictly configured to be so. + */ + if (ztype == FORWARDZONE && (rfc1918 || ula)) { + obj = NULL; + (void)cfg_map_get(zoptions, "forward", &obj); + if (obj == NULL) { + /* + * Forward mode not explicity configured. + */ + if (voptions != NULL) + cfg_map_get(voptions, "forward", &obj); + if (obj == NULL && goptions != NULL) + cfg_map_get(goptions, "forward", &obj); + if (obj == NULL || + strcasecmp(cfg_obj_asstring(obj), "first") == 0) + cfg_obj_log(zconfig, logctx, ISC_LOG_WARNING, + "inherited 'forward first;' for " + "%s zone '%s' - did you want " + "'forward only;'?", + rfc1918 ? "rfc1918" : "ula", + znamestr); + } + } + /* * Check validity of static stub server addresses. */ diff --git a/contrib/bind9/lib/bind9/include/bind9/Makefile.in b/contrib/bind9/lib/bind9/include/bind9/Makefile.in index 11ae58620..0ba184b51 100644 --- a/contrib/bind9/lib/bind9/include/bind9/Makefile.in +++ b/contrib/bind9/lib/bind9/include/bind9/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ # # Only list headers that are to be installed and are not diff --git a/contrib/bind9/lib/dns/Makefile.in b/contrib/bind9/lib/dns/Makefile.in index eec4c9ef0..ee2327a13 100644 --- a/contrib/bind9/lib/dns/Makefile.in +++ b/contrib/bind9/lib/dns/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2003 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -13,8 +13,6 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.180 2011/10/11 00:09:03 each Exp $ - srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ @@ -23,7 +21,7 @@ top_srcdir = @top_srcdir@ .NOTPARALLEL: .NO_PARALLEL: -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @LIBDNS_API@ @@ -53,7 +51,7 @@ OPENSSLLINKOBJS = openssl_link.@O@ openssldh_link.@O@ openssldsa_link.@O@ \ DSTOBJS = @DST_EXTRA_OBJS@ @OPENSSLLINKOBJS@ \ dst_api.@O@ dst_lib.@O@ dst_parse.@O@ dst_result.@O@ \ - gssapi_link.@O@ gssapictx.@O@ hmac_link.@O@ key.@O@ + gssapi_link.@O@ gssapictx.@O@ hmac_link.@O@ key.@O@ RRLOBJS = rrl.@O@ diff --git a/contrib/bind9/lib/dns/acache.c b/contrib/bind9/lib/dns/acache.c index d3d28f856..d7a11f764 100644 --- a/contrib/bind9/lib/dns/acache.c +++ b/contrib/bind9/lib/dns/acache.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2008, 2012, 2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2008, 2012, 2013, 2015 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -472,8 +472,7 @@ finddbent(dns_acache_t *acache, dns_db_t *db, dbentry_t **dbentryp) { * The caller must be holding the acache lock. */ - bucket = isc_hash_calc((const unsigned char *)&db, - sizeof(db), ISC_TRUE) % DBBUCKETS; + bucket = isc_hash_function(&db, sizeof(db), ISC_TRUE, NULL) % DBBUCKETS; for (dbentry = ISC_LIST_HEAD(acache->dbbucket[bucket]); dbentry != NULL; @@ -1264,8 +1263,7 @@ dns_acache_setdb(dns_acache_t *acache, dns_db_t *db) { dbentry->db = NULL; dns_db_attach(db, &dbentry->db); - bucket = isc_hash_calc((const unsigned char *)&db, - sizeof(db), ISC_TRUE) % DBBUCKETS; + bucket = isc_hash_function(&db, sizeof(db), ISC_TRUE, NULL) % DBBUCKETS; ISC_LIST_APPEND(acache->dbbucket[bucket], dbentry, link); @@ -1353,8 +1351,8 @@ dns_acache_putdb(dns_acache_t *acache, dns_db_t *db) { INSIST(ISC_LIST_EMPTY(dbentry->originlist) && ISC_LIST_EMPTY(dbentry->referlist)); - bucket = isc_hash_calc((const unsigned char *)&db, - sizeof(db), ISC_TRUE) % DBBUCKETS; + bucket = isc_hash_function(&db, sizeof(db), ISC_TRUE, NULL) % DBBUCKETS; + ISC_LIST_UNLINK(acache->dbbucket[bucket], dbentry, link); dns_db_detach(&dbentry->db); diff --git a/contrib/bind9/lib/dns/api b/contrib/bind9/lib/dns/api index df171fa19..95055594c 100644 --- a/contrib/bind9/lib/dns/api +++ b/contrib/bind9/lib/dns/api @@ -6,6 +6,6 @@ # 9.9-sub: 130-139, 150-159 # 9.10: 140-149 # 9.11: 160-169 -LIBINTERFACE = 170 -LIBREVISION = 3 -LIBAGE = 1 +LIBINTERFACE = 172 +LIBREVISION = 2 +LIBAGE = 0 diff --git a/contrib/bind9/lib/dns/cache.c b/contrib/bind9/lib/dns/cache.c index 098823314..0b6ddb46f 100644 --- a/contrib/bind9/lib/dns/cache.c +++ b/contrib/bind9/lib/dns/cache.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2011, 2013, 2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2011, 2013, 2015, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -1199,10 +1199,16 @@ static isc_result_t cleartree(dns_db_t *db, dns_name_t *name) { isc_result_t result, answer = ISC_R_SUCCESS; dns_dbiterator_t *iter = NULL; - dns_dbnode_t *node = NULL; + dns_dbnode_t *node = NULL, *top = NULL; dns_fixedname_t fnodename; dns_name_t *nodename; + /* + * Create the node if it doesn't exist so dns_dbiterator_seek() + * can find it. We will continue even if this fails. + */ + (void)dns_db_findnode(db, name, ISC_TRUE, &top); + dns_fixedname_init(&fnodename); nodename = dns_fixedname_name(&fnodename); @@ -1211,6 +1217,8 @@ cleartree(dns_db_t *db, dns_name_t *name) { goto cleanup; result = dns_dbiterator_seek(iter, name); + if (result == DNS_R_PARTIALMATCH) + result = dns_dbiterator_next(iter); if (result != ISC_R_SUCCESS) goto cleanup; @@ -1245,6 +1253,8 @@ cleartree(dns_db_t *db, dns_name_t *name) { dns_db_detachnode(db, &node); if (iter != NULL) dns_dbiterator_destroy(&iter); + if (top != NULL) + dns_db_detachnode(db, &top); return (answer); } @@ -1262,7 +1272,7 @@ dns_cache_flushnode(dns_cache_t *cache, dns_name_t *name, dns_dbnode_t *node = NULL; dns_db_t *db = NULL; - if (dns_name_equal(name, dns_rootname)) + if (tree && dns_name_equal(name, dns_rootname)) return (dns_cache_flush(cache)); LOCK(&cache->lock); diff --git a/contrib/bind9/lib/dns/client.c b/contrib/bind9/lib/dns/client.c index b433e348f..f21f666d3 100644 --- a/contrib/bind9/lib/dns/client.c +++ b/contrib/bind9/lib/dns/client.c @@ -1120,7 +1120,6 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) { UNLOCK(&rctx->lock); } - static void suspend(isc_task_t *task, isc_event_t *event) { isc_appctx_t *actx = event->ev_arg; @@ -1434,6 +1433,13 @@ dns_client_destroyrestrans(dns_clientrestrans_t **transp) { mctx = client->mctx; dns_view_detach(&rctx->view); + /* + * Wait for the lock in client_resfind to be released before + * destroying the lock. + */ + LOCK(&rctx->lock); + UNLOCK(&rctx->lock); + LOCK(&client->lock); INSIST(ISC_LINK_LINKED(rctx, link)); diff --git a/contrib/bind9/lib/dns/dst_api.c b/contrib/bind9/lib/dns/dst_api.c index 680a01843..5834a5822 100644 --- a/contrib/bind9/lib/dns/dst_api.c +++ b/contrib/bind9/lib/dns/dst_api.c @@ -1,5 +1,5 @@ /* - * Portions Copyright (C) 2004-2013, 2015 Internet Systems Consortium, Inc. ("ISC") + * Portions Copyright (C) 2004-2013, 2015, 2016 Internet Systems Consortium, Inc. ("ISC") * Portions Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -302,12 +302,15 @@ dst_context_create2(dst_key_t *key, isc_mem_t *mctx, dctx = isc_mem_get(mctx, sizeof(dst_context_t)); if (dctx == NULL) return (ISC_R_NOMEMORY); - dctx->key = key; - dctx->mctx = mctx; + memset(dctx, 0, sizeof(*dctx)); + dst_key_attach(key, &dctx->key); + isc_mem_attach(mctx, &dctx->mctx); dctx->category = category; result = key->func->createctx(key, dctx); if (result != ISC_R_SUCCESS) { - isc_mem_put(mctx, dctx, sizeof(dst_context_t)); + if (dctx->key != NULL) + dst_key_free(&dctx->key); + isc_mem_putanddetach(&dctx->mctx, dctx, sizeof(dst_context_t)); return (result); } dctx->magic = CTX_MAGIC; @@ -324,8 +327,10 @@ dst_context_destroy(dst_context_t **dctxp) { dctx = *dctxp; INSIST(dctx->key->func->destroyctx != NULL); dctx->key->func->destroyctx(dctx); + if (dctx->key != NULL) + dst_key_free(&dctx->key); dctx->magic = 0; - isc_mem_put(dctx->mctx, dctx, sizeof(dst_context_t)); + isc_mem_putanddetach(&dctx->mctx, dctx, sizeof(dst_context_t)); *dctxp = NULL; } diff --git a/contrib/bind9/lib/dns/dst_openssl.h b/contrib/bind9/lib/dns/dst_openssl.h index dd6740586..12f8bfcd6 100644 --- a/contrib/bind9/lib/dns/dst_openssl.h +++ b/contrib/bind9/lib/dns/dst_openssl.h @@ -36,7 +36,7 @@ #define USE_ENGINE 1 #endif -#if OPENSSL_VERSION_NUMBER < 0x10100000L +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) /* * These are new in OpenSSL 1.1.0. BN_GENCB _cb needs to be declared in * the function like this before the BN_GENCB_new call: diff --git a/contrib/bind9/lib/dns/forward.c b/contrib/bind9/lib/dns/forward.c index 7ec4e5c9d..c465ddf90 100644 --- a/contrib/bind9/lib/dns/forward.c +++ b/contrib/bind9/lib/dns/forward.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,8 +15,6 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: forward.c,v 1.14 2009/09/02 23:48:02 tbox Exp $ */ - /*! \file */ #include @@ -24,7 +22,6 @@ #include #include #include -#include #include #include diff --git a/contrib/bind9/lib/dns/gen.c b/contrib/bind9/lib/dns/gen.c index 7a7dafb46..4a8d50ea5 100644 --- a/contrib/bind9/lib/dns/gen.c +++ b/contrib/bind9/lib/dns/gen.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2012-2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2012-2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -770,7 +770,7 @@ main(int argc, char **argv) { continue; if (hash == HASH(ttn2->typename)) { fprintf(stdout, "\t\t\tRDATATYPE_COMPARE" - "(\"%s\", %u, " + "(\"%s\", %d, " "_typename, _length, _typep); \\\n", ttn2->typename, ttn2->type); ttn2->sorted = 1; @@ -786,7 +786,7 @@ main(int argc, char **argv) { ttn = find_typename(i); if (ttn == NULL) continue; - fprintf(stdout, "\tcase %u: return (%s); \\\n", + fprintf(stdout, "\tcase %d: return (%s); \\\n", i, upper(ttn->attr)); } fprintf(stdout, "\t}\n"); @@ -805,7 +805,7 @@ main(int argc, char **argv) { */ if (i == 65533U) continue; - fprintf(stdout, "\tcase %u: return " + fprintf(stdout, "\tcase %d: return " "(str_totext(\"%s\", target)); \\\n", i, upper(ttn->typename)); } diff --git a/contrib/bind9/lib/dns/include/dns/Makefile.in b/contrib/bind9/lib/dns/include/dns/Makefile.in index 640a63e2c..6be914d9f 100644 --- a/contrib/bind9/lib/dns/include/dns/Makefile.in +++ b/contrib/bind9/lib/dns/include/dns/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2007-2009, 2011, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007-2009, 2011, 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2003 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = acache.h acl.h adb.h bit.h byaddr.h cache.h callbacks.h cert.h \ client.h clientinfo.h compress.h \ diff --git a/contrib/bind9/lib/dns/include/dns/dbiterator.h b/contrib/bind9/lib/dns/include/dns/dbiterator.h index 366d6767a..c36f18d48 100644 --- a/contrib/bind9/lib/dns/include/dns/dbiterator.h +++ b/contrib/bind9/lib/dns/include/dns/dbiterator.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -166,6 +166,8 @@ dns_dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name); * Returns: *\li #ISC_R_SUCCESS *\li #ISC_R_NOTFOUND + *\li #DNS_R_PARTIALMATCH + * (node is at name above requested named when name has children) * *\li Other results are possible, depending on the DB implementation. */ @@ -286,7 +288,7 @@ dns_dbiterator_setcleanmode(dns_dbiterator_t *iterator, isc_boolean_t mode); * Indicate that the given iterator is/is not cleaning the DB. * * Notes: - *\li When 'mode' is ISC_TRUE, + *\li When 'mode' is ISC_TRUE, * * Requires: *\li 'iterator' is a valid iterator. diff --git a/contrib/bind9/lib/dns/include/dns/forward.h b/contrib/bind9/lib/dns/include/dns/forward.h index 23e94be78..9bda7989a 100644 --- a/contrib/bind9/lib/dns/include/dns/forward.h +++ b/contrib/bind9/lib/dns/include/dns/forward.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,8 +15,6 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: forward.h,v 1.13 2009/09/02 23:48:02 tbox Exp $ */ - #ifndef DNS_FORWARD_H #define DNS_FORWARD_H 1 @@ -24,6 +22,7 @@ #include #include +#include #include diff --git a/contrib/bind9/lib/dns/include/dns/message.h b/contrib/bind9/lib/dns/include/dns/message.h index 395d066a4..191920ff7 100644 --- a/contrib/bind9/lib/dns/include/dns/message.h +++ b/contrib/bind9/lib/dns/include/dns/message.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2010, 2012-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2010, 2012-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -102,10 +102,11 @@ #define DNS_MESSAGEEXTFLAG_DO 0x8000U /*%< EDNS0 extended OPT codes */ -#define DNS_OPT_NSID 0x0003 /*%< NSID opt code */ -#define DNS_OPT_CLIENT_SUBNET 0x0008 /*%< client subnet opt code */ -#define DNS_OPT_EXPIRE 0x0009 /*%< EXPIRE opt code */ -#define DNS_OPT_COOKIE 0x000a /*%< COOKIE opt code */ +#define DNS_OPT_NSID 3 /*%< NSID opt code */ +#define DNS_OPT_CLIENT_SUBNET 8 /*%< client subnet opt code */ +#define DNS_OPT_EXPIRE 9 /*%< EXPIRE opt code */ +#define DNS_OPT_COOKIE 10 /*%< COOKIE opt code */ +#define DNS_OPT_PAD 12 /*%< PAD opt code */ /*%< The number of EDNS options we know about. */ #define DNS_EDNSOPTIONS 4 diff --git a/contrib/bind9/lib/dns/include/dns/name.h b/contrib/bind9/lib/dns/include/dns/name.h index d6e9a90c1..48abbace0 100644 --- a/contrib/bind9/lib/dns/include/dns/name.h +++ b/contrib/bind9/lib/dns/include/dns/name.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009-2012, 2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009-2012, 2015, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -1286,6 +1286,18 @@ dns_name_isdnssd(const dns_name_t *owner); * Determine if the 'owner' is a DNS-SD prefix. */ +isc_boolean_t +dns_name_isrfc1918(const dns_name_t *owner); +/*%< + * Determine if the 'name' is in the RFC 1918 reverse namespace. + */ + +isc_boolean_t +dns_name_isula(const dns_name_t *owner); +/*%< + * Determine if the 'name' is in the ULA reverse namespace. + */ + ISC_LANG_ENDDECLS /* diff --git a/contrib/bind9/lib/dns/include/dns/rbt.h b/contrib/bind9/lib/dns/include/dns/rbt.h index 947e7c177..490cf6f8b 100644 --- a/contrib/bind9/lib/dns/include/dns/rbt.h +++ b/contrib/bind9/lib/dns/include/dns/rbt.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -80,21 +80,6 @@ struct dns_rbtnode { #if DNS_RBT_USEMAGIC unsigned int magic; #endif - dns_rbtnode_t *parent; - dns_rbtnode_t *left; - dns_rbtnode_t *right; - dns_rbtnode_t *down; -#ifdef DNS_RBT_USEHASH - dns_rbtnode_t *hashnext; -#endif - - /*% - * Used for LRU cache. This linked list is used to mark nodes which - * have no data any longer, but we cannot unlink at that exact moment - * because we did not or could not obtain a write lock on the tree. - */ - ISC_LINK(dns_rbtnode_t) deadlink; - /*@{*/ /*! * The following bitfields add up to a total bitwidth of 32. @@ -104,7 +89,18 @@ struct dns_rbtnode { * * In each case below the "range" indicated is what's _necessary_ for * the bitfield to hold, not what it actually _can_ hold. + * + * Note: Tree lock must be held before modifying these + * bit-fields. + * + * Note: The two "unsigned int :0;" unnamed bitfields on either + * side of the bitfields below are scaffolding that border the + * set of bitfields which are accessed after acquiring the tree + * lock. Please don't insert any other bitfield members between + * the unnamed bitfields unless they should also be accessed + * after acquiring the tree lock. */ + unsigned int :0; /* start of bitfields c/o tree lock */ unsigned int is_root : 1; /*%< range is 0..1 */ unsigned int color : 1; /*%< range is 0..1 */ unsigned int find_callback : 1; /*%< range is 0..1 */ @@ -117,23 +113,53 @@ struct dns_rbtnode { /* node needs to be cleaned from rpz */ unsigned int rpz : 1; + unsigned int :0; /* end of bitfields c/o tree lock */ #ifdef DNS_RBT_USEHASH unsigned int hashval; + dns_rbtnode_t *uppernode; + dns_rbtnode_t *hashnext; #endif + dns_rbtnode_t *parent; + dns_rbtnode_t *left; + dns_rbtnode_t *right; + dns_rbtnode_t *down; + + /*% + * Used for LRU cache. This linked list is used to mark nodes which + * have no data any longer, but we cannot unlink at that exact moment + * because we did not or could not obtain a write lock on the tree. + */ + ISC_LINK(dns_rbtnode_t) deadlink; /*@{*/ /*! * These values are used in the RBT DB implementation. The appropriate * node lock must be held before accessing them. + * + * Note: The two "unsigned int :0;" unnamed bitfields on either + * side of the bitfields below are scaffolding that border the + * set of bitfields which are accessed after acquiring the node + * lock. Please don't insert any other bitfield members between + * the unnamed bitfields unless they should also be accessed + * after acquiring the node lock. + * + * NOTE: Do not merge these fields into bitfields above, as + * they'll all be put in the same qword that could be accessed + * without the node lock as it shares the qword with other + * members. Leave these members here so that they occupy a + * separate region of memory. */ void *data; + unsigned int :0; /* start of bitfields c/o node lock */ unsigned int dirty:1; unsigned int wild:1; unsigned int locknum:DNS_RBT_LOCKLENGTH; #ifndef DNS_RBT_USEISCREFCOUNT unsigned int references:DNS_RBT_REFLENGTH; -#else +#endif + unsigned int :0; /* end of bitfields c/o node lock */ +#ifdef DNS_RBT_USEISCREFCOUNT isc_refcount_t references; /* note that this is not in the bitfield */ #endif /*@}*/ diff --git a/contrib/bind9/lib/dns/include/dns/view.h b/contrib/bind9/lib/dns/include/dns/view.h index b9d6084f3..6f4f4f937 100644 --- a/contrib/bind9/lib/dns/include/dns/view.h +++ b/contrib/bind9/lib/dns/include/dns/view.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2014, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -1082,6 +1082,12 @@ dns_view_untrust(dns_view_t *view, dns_name_t *keyname, * Remove keys that match 'keyname' and 'dnskey' from the views trust * anchors. * + * (NOTE: If the configuration specifies that there should be a + * trust anchor at 'keyname', but no keys are left after this + * operation, that is an error. We fail closed, inserting a NULL + * key so as to prevent validation until a legimitate key has been + * provided.) + * * Requires: * \li 'view' is valid. * \li 'keyname' is valid. diff --git a/contrib/bind9/lib/dns/include/dst/Makefile.in b/contrib/bind9/lib/dns/include/dst/Makefile.in index cece67dd3..293e0edf7 100644 --- a/contrib/bind9/lib/dns/include/dst/Makefile.in +++ b/contrib/bind9/lib/dns/include/dst/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2001 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = dst.h gssapi.h lib.h result.h diff --git a/contrib/bind9/lib/dns/journal.c b/contrib/bind9/lib/dns/journal.c index 4811ebbd8..102efd16f 100644 --- a/contrib/bind9/lib/dns/journal.c +++ b/contrib/bind9/lib/dns/journal.c @@ -677,11 +677,12 @@ journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t writable, failure: j->magic = 0; - if (j->index != NULL) { - isc_mem_put(j->mctx, j->index, j->header.index_size * + if (j->rawindex != NULL) + isc_mem_put(j->mctx, j->rawindex, j->header.index_size * sizeof(journal_rawpos_t)); - j->index = NULL; - } + if (j->index != NULL) + isc_mem_put(j->mctx, j->index, j->header.index_size * + sizeof(journal_pos_t)); if (j->filename != NULL) isc_mem_free(j->mctx, j->filename); if (j->fp != NULL) diff --git a/contrib/bind9/lib/dns/master.c b/contrib/bind9/lib/dns/master.c index 4dba0d7c5..beb0ae661 100644 --- a/contrib/bind9/lib/dns/master.c +++ b/contrib/bind9/lib/dns/master.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2011-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2011-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -147,6 +147,7 @@ struct dns_loadctx { isc_uint32_t references; dns_incctx_t *inc; isc_uint32_t resign; + isc_stdtime_t now; }; struct dns_incctx { @@ -601,6 +602,7 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx, lctx->zclass = zclass; lctx->resign = resign; lctx->result = ISC_R_SUCCESS; + isc_stdtime_get(&lctx->now); dns_fixedname_init(&lctx->fixed_top); lctx->top = dns_fixedname_name(&lctx->fixed_top); @@ -816,7 +818,7 @@ generate(dns_loadctx_t *lctx, char *range, char *lhs, char *gtype, char *rhs, isc_textregion_t r; int i, n, start, stop, step = 0; dns_incctx_t *ictx; - char dummy; + char dummy[2]; ictx = lctx->inc; callbacks = lctx->callbacks; @@ -833,7 +835,7 @@ generate(dns_loadctx_t *lctx, char *range, char *lhs, char *gtype, char *rhs, } isc_buffer_init(&target, target_mem, target_size); - n = sscanf(range, "%d-%d%[/]%d", &start, &stop, &dummy, &step); + n = sscanf(range, "%d-%d%1[/]%d", &start, &stop, dummy, &step); if ((n != 2 && n != 4) || (start < 0) || (stop < 0) || (n == 4 && step < 1) || (stop < start)) { @@ -1061,7 +1063,6 @@ load_text(dns_loadctx_t *lctx) { const char *source = ""; unsigned long line = 0; isc_boolean_t explicit_ttl; - isc_stdtime_t now; char classname1[DNS_RDATACLASS_FORMATSIZE]; char classname2[DNS_RDATACLASS_FORMATSIZE]; unsigned int options = 0; @@ -1074,7 +1075,6 @@ load_text(dns_loadctx_t *lctx) { ISC_LIST_INIT(glue_list); ISC_LIST_INIT(current_list); - isc_stdtime_get(&now); /* * Allocate target_size of buffer space. This is greater than twice @@ -1115,6 +1115,7 @@ load_text(dns_loadctx_t *lctx) { incctx_destroy(lctx->mctx, ictx); RUNTIME_CHECK(isc_lex_close(lctx->lex) == ISC_R_SUCCESS); line = isc_lex_getsourceline(lctx->lex); + POST(line); source = isc_lex_getsourcename(lctx->lex); ictx = lctx->inc; continue; @@ -1888,7 +1889,7 @@ load_text(dns_loadctx_t *lctx) { result = dns_rdata_tostruct(&rdata[rdcount], &sig, NULL); RUNTIME_CHECK(result == ISC_R_SUCCESS); - if (isc_serial_lt(sig.timeexpire, now)) { + if (isc_serial_lt(sig.timeexpire, lctx->now)) { (*callbacks->warn)(callbacks, "%s:%lu: " "signature has expired", @@ -2090,12 +2091,18 @@ pushfile(const char *master_file, dns_name_t *origin, dns_loadctx_t *lctx) { return (result); } +/* + * Fill/check exists buffer with 'len' bytes. Track remaining bytes to be + * read when incrementally filling the buffer. + */ static inline isc_result_t read_and_check(isc_boolean_t do_read, isc_buffer_t *buffer, - size_t len, FILE *f) + size_t len, FILE *f, isc_uint32_t *totallen) { isc_result_t result; + REQUIRE(totallen != NULL); + if (do_read) { INSIST(isc_buffer_availablelength(buffer) >= len); result = isc_stdio_read(isc_buffer_used(buffer), 1, len, @@ -2103,6 +2110,9 @@ read_and_check(isc_boolean_t do_read, isc_buffer_t *buffer, if (result != ISC_R_SUCCESS) return (result); isc_buffer_add(buffer, (unsigned int)len); + if (*totallen < len) + return (ISC_R_RANGE); + *totallen -= (isc_uint32_t)len; } else if (isc_buffer_remaininglength(buffer) < len) return (ISC_R_RANGE); @@ -2129,7 +2139,6 @@ load_raw(dns_loadctx_t *lctx) { dns_masterrawheader_t header; dns_decompress_t dctx; - REQUIRE(DNS_LCTX_VALID(lctx)); callbacks = lctx->callbacks; dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE); @@ -2245,6 +2254,7 @@ load_raw(dns_loadctx_t *lctx) { goto cleanup; isc_buffer_add(&target, sizeof(totallen)); totallen = isc_buffer_getuint32(&target); + /* * Validation: the input data must at least contain the common * header. @@ -2286,10 +2296,15 @@ load_raw(dns_loadctx_t *lctx) { if (result != ISC_R_SUCCESS) goto cleanup; isc_buffer_add(&target, (unsigned int)readlen); + totallen -= (isc_uint32_t)readlen; /* Construct RRset headers */ dns_rdatalist_init(&rdatalist); rdatalist.rdclass = isc_buffer_getuint16(&target); + if (lctx->zclass != rdatalist.rdclass) { + result = DNS_R_BADCLASS; + goto cleanup; + } rdatalist.type = isc_buffer_getuint16(&target); rdatalist.covers = isc_buffer_getuint16(&target); rdatalist.ttl = isc_buffer_getuint32(&target); @@ -2302,7 +2317,7 @@ load_raw(dns_loadctx_t *lctx) { /* Owner name: length followed by name */ result = read_and_check(sequential_read, &target, - sizeof(namelen), lctx->f); + sizeof(namelen), lctx->f, &totallen); if (result != ISC_R_SUCCESS) goto cleanup; namelen = isc_buffer_getuint16(&target); @@ -2312,7 +2327,7 @@ load_raw(dns_loadctx_t *lctx) { } result = read_and_check(sequential_read, &target, namelen, - lctx->f); + lctx->f, &totallen); if (result != ISC_R_SUCCESS) goto cleanup; @@ -2370,14 +2385,15 @@ load_raw(dns_loadctx_t *lctx) { /* rdata length */ result = read_and_check(sequential_read, &target, - sizeof(rdlen), lctx->f); + sizeof(rdlen), lctx->f, + &totallen); if (result != ISC_R_SUCCESS) goto cleanup; rdlen = isc_buffer_getuint16(&target); /* rdata */ result = read_and_check(sequential_read, &target, - rdlen, lctx->f); + rdlen, lctx->f, &totallen); if (result != ISC_R_SUCCESS) goto cleanup; isc_buffer_setactive(&target, (unsigned int)rdlen); @@ -2403,7 +2419,7 @@ load_raw(dns_loadctx_t *lctx) { * necessarily critical, but it very likely indicates broken * or malformed data. */ - if (isc_buffer_remaininglength(&target) != 0) { + if (isc_buffer_remaininglength(&target) != 0 || totallen != 0) { result = ISC_R_RANGE; goto cleanup; } @@ -2856,7 +2872,7 @@ grow_rdata(int new_len, dns_rdata_t *old, int old_len, } static isc_uint32_t -resign_fromlist(dns_rdatalist_t *this, isc_uint32_t resign) { +resign_fromlist(dns_rdatalist_t *this, dns_loadctx_t *lctx) { dns_rdata_t *rdata; dns_rdata_rrsig_t sig; isc_uint32_t when; @@ -2864,13 +2880,18 @@ resign_fromlist(dns_rdatalist_t *this, isc_uint32_t resign) { rdata = ISC_LIST_HEAD(this->rdata); INSIST(rdata != NULL); (void)dns_rdata_tostruct(rdata, &sig, NULL); - when = sig.timeexpire - resign; + if (isc_serial_gt(sig.timesigned, lctx->now)) + when = lctx->now; + else + when = sig.timeexpire - lctx->resign; rdata = ISC_LIST_NEXT(rdata, link); while (rdata != NULL) { (void)dns_rdata_tostruct(rdata, &sig, NULL); - if (sig.timeexpire - resign < when) - when = sig.timeexpire - resign; + if (isc_serial_gt(sig.timesigned, lctx->now)) + when = lctx->now; + else if (sig.timeexpire - lctx->resign < when) + when = sig.timeexpire - lctx->resign; rdata = ISC_LIST_NEXT(rdata, link); } return (when); @@ -2908,8 +2929,7 @@ commit(dns_rdatacallbacks_t *callbacks, dns_loadctx_t *lctx, if (dataset.type == dns_rdatatype_rrsig && (lctx->options & DNS_MASTER_RESIGN) != 0) { dataset.attributes |= DNS_RDATASETATTR_RESIGN; - dns_name_format(owner, namebuf, sizeof(namebuf)); - dataset.resign = resign_fromlist(this, lctx->resign); + dataset.resign = resign_fromlist(this, lctx); } result = ((*callbacks->add)(callbacks->add_private, owner, &dataset)); diff --git a/contrib/bind9/lib/dns/message.c b/contrib/bind9/lib/dns/message.c index d3ae609a6..869d25823 100644 --- a/contrib/bind9/lib/dns/message.c +++ b/contrib/bind9/lib/dns/message.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -36,6 +36,7 @@ #include #include #include +#include #include #include #include @@ -145,27 +146,6 @@ static const char *opcodetext[] = { "RESERVED15" }; -static const char *rcodetext[] = { - "NOERROR", - "FORMERR", - "SERVFAIL", - "NXDOMAIN", - "NOTIMP", - "REFUSED", - "YXDOMAIN", - "YXRRSET", - "NXRRSET", - "NOTAUTH", - "NOTZONE", - "RESERVED11", - "RESERVED12", - "RESERVED13", - "RESERVED14", - "RESERVED15", - "BADVERS" -}; - - /*% * "helper" type, which consists of a block of some type, and is linkable. * For it to work, sizeof(dns_msgblock_t) must be a multiple of the pointer @@ -850,9 +830,8 @@ dns_message_find(dns_name_t *name, dns_rdataclass_t rdclass, { dns_rdataset_t *curr; - if (rdataset != NULL) { - REQUIRE(*rdataset == NULL); - } + REQUIRE(name != NULL); + REQUIRE(rdataset == NULL || *rdataset == NULL); for (curr = ISC_LIST_TAIL(name->list); curr != NULL; @@ -875,15 +854,13 @@ dns_message_findtype(dns_name_t *name, dns_rdatatype_t type, dns_rdataset_t *curr; REQUIRE(name != NULL); - if (rdataset != NULL) { - REQUIRE(*rdataset == NULL); - } + REQUIRE(rdataset == NULL || *rdataset == NULL); for (curr = ISC_LIST_TAIL(name->list); curr != NULL; curr = ISC_LIST_PREV(curr, link)) { if (curr->type == type && curr->covers == covers) { - if (rdataset != NULL) + if (ISC_UNLIKELY(rdataset != NULL)) *rdataset = curr; return (ISC_R_SUCCESS); } @@ -1300,6 +1277,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx, * it must be the first OPT we've seen. */ if (!dns_name_equal(dns_rootname, name) || + sectionid != DNS_SECTION_ADDITIONAL || msg->opt != NULL) DO_FORMERR; skip_name_search = ISC_TRUE; @@ -1541,9 +1519,12 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx, ISC_LIST_APPEND(rdatalist->rdata, rdata, link); /* - * If this is an OPT record, remember it. Also, set - * the extended rcode. Note that msg->opt will only be set - * if best-effort parsing is enabled. + * If this is an OPT, SIG(0) or TSIG record, remember it. + * Also, set the extended rcode for TSIG. + * + * Note msg->opt, msg->sig0 and msg->tsig will only be + * already set if best-effort parsing is enabled otherwise + * there will only be at most one of each. */ if (rdtype == dns_rdatatype_opt && msg->opt == NULL) { dns_rcode_t ercode; @@ -1557,14 +1538,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx, msg->rcode |= ercode; isc_mempool_put(msg->namepool, name); free_name = ISC_FALSE; - } - - /* - * If this is an SIG(0) or TSIG record, remember it. Note - * that msg->sig0 or msg->tsig will only be set if best-effort - * parsing is enabled. - */ - if (issigzero && msg->sig0 == NULL) { + } else if (issigzero && msg->sig0 == NULL) { msg->sig0 = rdataset; msg->sig0name = name; rdataset = NULL; @@ -1748,7 +1722,7 @@ dns_message_renderbegin(dns_message_t *msg, dns_compress_t *cctx, if (r.length < DNS_MESSAGE_HEADERLEN) return (ISC_R_NOSPACE); - if (r.length < msg->reserved) + if (r.length - DNS_MESSAGE_HEADERLEN < msg->reserved) return (ISC_R_NOSPACE); /* @@ -1889,8 +1863,29 @@ norender_rdataset(const dns_rdataset_t *rdataset, unsigned int options, return (ISC_TRUE); } - #endif + +static isc_result_t +renderset(dns_rdataset_t *rdataset, dns_name_t *owner_name, + dns_compress_t *cctx, isc_buffer_t *target, + unsigned int reserved, unsigned int options, unsigned int *countp) +{ + isc_result_t result; + + /* + * Shrink the space in the buffer by the reserved amount. + */ + if (target->length - target->used < reserved) + return (ISC_R_NOSPACE); + + target->length -= reserved; + result = dns_rdataset_towire(rdataset, owner_name, + cctx, target, options, countp); + target->length += reserved; + + return (result); +} + isc_result_t dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid, unsigned int options) @@ -1933,6 +1928,8 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid, /* * Shrink the space in the buffer by the reserved amount. */ + if (msg->buffer->length - msg->buffer->used < msg->reserved) + return (ISC_R_NOSPACE); msg->buffer->length -= msg->reserved; total = 0; @@ -2208,9 +2205,8 @@ dns_message_renderend(dns_message_t *msg) { * Render. */ count = 0; - result = dns_rdataset_towire(msg->opt, dns_rootname, - msg->cctx, msg->buffer, 0, - &count); + result = renderset(msg->opt, dns_rootname, msg->cctx, + msg->buffer, msg->reserved, 0, &count); msg->counts[DNS_SECTION_ADDITIONAL] += count; if (result != ISC_R_SUCCESS) return (result); @@ -2226,9 +2222,8 @@ dns_message_renderend(dns_message_t *msg) { if (result != ISC_R_SUCCESS) return (result); count = 0; - result = dns_rdataset_towire(msg->tsig, msg->tsigname, - msg->cctx, msg->buffer, 0, - &count); + result = renderset(msg->tsig, msg->tsigname, msg->cctx, + msg->buffer, msg->reserved, 0, &count); msg->counts[DNS_SECTION_ADDITIONAL] += count; if (result != ISC_R_SUCCESS) return (result); @@ -2249,9 +2244,8 @@ dns_message_renderend(dns_message_t *msg) { * the owner name of a SIG(0) is irrelevant, and will not * be set in a message being rendered. */ - result = dns_rdataset_towire(msg->sig0, dns_rootname, - msg->cctx, msg->buffer, 0, - &count); + result = renderset(msg->sig0, dns_rootname, msg->cctx, + msg->buffer, msg->reserved, 0, &count); msg->counts[DNS_SECTION_ADDITIONAL] += count; if (result != ISC_R_SUCCESS) return (result); @@ -2364,13 +2358,12 @@ dns_message_findname(dns_message_t *msg, dns_section_t section, REQUIRE(msg != NULL); REQUIRE(VALID_SECTION(section)); REQUIRE(target != NULL); - if (name != NULL) - REQUIRE(*name == NULL); + REQUIRE(name == NULL || *name == NULL); + if (type == dns_rdatatype_any) { REQUIRE(rdataset == NULL); } else { - if (rdataset != NULL) - REQUIRE(*rdataset == NULL); + REQUIRE(rdataset == NULL || *rdataset == NULL); } result = findname(&foundname, target, @@ -2387,7 +2380,7 @@ dns_message_findname(dns_message_t *msg, dns_section_t section, /* * And now look for the type. */ - if (type == dns_rdatatype_any) + if (ISC_UNLIKELY(type == dns_rdatatype_any)) return (ISC_R_SUCCESS); result = dns_message_findtype(foundname, type, covers, rdataset); @@ -3277,7 +3270,7 @@ dns_message_pseudosectiontotext(dns_message_t *msg, mbz &= ~DNS_MESSAGEEXTFLAG_DO; /* Known Flags. */ if (mbz != 0) { ADD_STRING(target, "; MBZ: "); - snprintf(buf, sizeof(buf), "%.4x ", mbz); + snprintf(buf, sizeof(buf), "0x%.4x", mbz); ADD_STRING(target, buf); ADD_STRING(target, ", udp: "); } else @@ -3313,11 +3306,17 @@ dns_message_pseudosectiontotext(dns_message_t *msg, snprintf(buf, sizeof(buf), "%u", secs); ADD_STRING(target, buf); ADD_STRING(target, " ("); - dns_ttl_totext(secs, ISC_TRUE, target); + result = dns_ttl_totext(secs, + ISC_TRUE, + target); + if (result != ISC_R_SUCCESS) + return (result); ADD_STRING(target, ")\n"); continue; } ADD_STRING(target, "; EXPIRE"); + } else if (optcode == DNS_OPT_PAD) { + ADD_STRING(target, "; PAD"); } else { ADD_STRING(target, "; OPT="); snprintf(buf, sizeof(buf), "%u", optcode); @@ -3399,7 +3398,8 @@ dns_message_pseudosectiontotext(dns_message_t *msg, isc_result_t dns_message_totext(dns_message_t *msg, const dns_master_style_t *style, - dns_messagetextflag_t flags, isc_buffer_t *target) { + dns_messagetextflag_t flags, isc_buffer_t *target) +{ char buf[sizeof("1234567890")]; isc_result_t result; @@ -3410,12 +3410,9 @@ dns_message_totext(dns_message_t *msg, const dns_master_style_t *style, ADD_STRING(target, ";; ->>HEADER<<- opcode: "); ADD_STRING(target, opcodetext[msg->opcode]); ADD_STRING(target, ", status: "); - if (msg->rcode < (sizeof(rcodetext)/sizeof(rcodetext[0]))) { - ADD_STRING(target, rcodetext[msg->rcode]); - } else { - snprintf(buf, sizeof(buf), "%4u", msg->rcode); - ADD_STRING(target, buf); - } + result = dns_rcode_totext(msg->rcode, target); + if (result != ISC_R_SUCCESS) + return (result); ADD_STRING(target, ", id: "); snprintf(buf, sizeof(buf), "%6u", msg->id); ADD_STRING(target, buf); diff --git a/contrib/bind9/lib/dns/name.c b/contrib/bind9/lib/dns/name.c index 6db373c03..a14f12bd7 100644 --- a/contrib/bind9/lib/dns/name.c +++ b/contrib/bind9/lib/dns/name.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -29,6 +29,7 @@ #include #include #include +#include #include #include #include @@ -438,42 +439,10 @@ dns_name_internalwildcard(const dns_name_t *name) { return (ISC_FALSE); } -static inline unsigned int -name_hash(dns_name_t *name, isc_boolean_t case_sensitive) { - unsigned int length; - const unsigned char *s; - unsigned int h = 0; - unsigned char c; - - length = name->length; - if (length > 16) - length = 16; - - /* - * This hash function is similar to the one Ousterhout - * uses in Tcl. - */ - s = name->ndata; - if (case_sensitive) { - while (length > 0) { - h += ( h << 3 ) + *s; - s++; - length--; - } - } else { - while (length > 0) { - c = maptolower[*s]; - h += ( h << 3 ) + c; - s++; - length--; - } - } - - return (h); -} - unsigned int dns_name_hash(dns_name_t *name, isc_boolean_t case_sensitive) { + unsigned int length; + /* * Provide a hash value for 'name'. */ @@ -482,7 +451,12 @@ dns_name_hash(dns_name_t *name, isc_boolean_t case_sensitive) { if (name->labels == 0) return (0); - return (name_hash(name, case_sensitive)); + length = name->length; + if (length > 16) + length = 16; + + return (isc_hash_function_reverse(name->ndata, length, + case_sensitive, NULL)); } unsigned int @@ -495,19 +469,17 @@ dns_name_fullhash(dns_name_t *name, isc_boolean_t case_sensitive) { if (name->labels == 0) return (0); - return (isc_hash_calc((const unsigned char *)name->ndata, - name->length, case_sensitive)); + return (isc_hash_function_reverse(name->ndata, name->length, + case_sensitive, NULL)); } unsigned int dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive) { /* * This function was deprecated due to the breakage of the name space - * convention. We only keep this internally to provide binary backward + * convention. We only keep this internally to provide binary backward * compatibility. */ - REQUIRE(VALID_NAME(name)); - return (dns_name_fullhash(name, case_sensitive)); } @@ -527,7 +499,8 @@ dns_name_hashbylabel(dns_name_t *name, isc_boolean_t case_sensitive) { if (name->labels == 0) return (0); else if (name->labels == 1) - return (name_hash(name, case_sensitive)); + return (isc_hash_function_reverse(name->ndata, name->length, + case_sensitive, NULL)); SETUP_OFFSETS(name, offsets, odata); DNS_NAME_INIT(&tname, NULL); @@ -539,7 +512,8 @@ dns_name_hashbylabel(dns_name_t *name, isc_boolean_t case_sensitive) { tname.length = name->length - offsets[i]; else tname.length = offsets[i + 1] - offsets[i]; - h += name_hash(&tname, case_sensitive); + h += isc_hash_function_reverse(tname.ndata, tname.length, + case_sensitive, NULL); } return (h); @@ -577,7 +551,7 @@ dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2, REQUIRE((name1->attributes & DNS_NAMEATTR_ABSOLUTE) == (name2->attributes & DNS_NAMEATTR_ABSOLUTE)); - if (name1 == name2) { + if (ISC_UNLIKELY(name1 == name2)) { *orderp = 0; *nlabelsp = name1->labels; return (dns_namereln_equal); @@ -597,12 +571,15 @@ dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2, ldiff = l1 - l2; } - while (l > 0) { + offsets1 += l1; + offsets2 += l2; + + while (ISC_LIKELY(l > 0)) { l--; - l1--; - l2--; - label1 = &name1->ndata[offsets1[l1]]; - label2 = &name2->ndata[offsets2[l2]]; + offsets1--; + offsets2--; + label1 = &name1->ndata[*offsets1]; + label2 = &name2->ndata[*offsets2]; count1 = *label1++; count2 = *label2++; @@ -618,16 +595,43 @@ dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2, else count = count2; - while (count > 0) { - chdiff = (int)maptolower[*label1] - - (int)maptolower[*label2]; + /* Loop unrolled for performance */ + while (ISC_LIKELY(count > 3)) { + chdiff = (int)maptolower[label1[0]] - + (int)maptolower[label2[0]]; + if (chdiff != 0) { + *orderp = chdiff; + goto done; + } + chdiff = (int)maptolower[label1[1]] - + (int)maptolower[label2[1]]; + if (chdiff != 0) { + *orderp = chdiff; + goto done; + } + chdiff = (int)maptolower[label1[2]] - + (int)maptolower[label2[2]]; + if (chdiff != 0) { + *orderp = chdiff; + goto done; + } + chdiff = (int)maptolower[label1[3]] - + (int)maptolower[label2[3]]; + if (chdiff != 0) { + *orderp = chdiff; + goto done; + } + count -= 4; + label1 += 4; + label2 += 4; + } + while (ISC_LIKELY(count-- > 0)) { + chdiff = (int)maptolower[*label1++] - + (int)maptolower[*label2++]; if (chdiff != 0) { *orderp = chdiff; goto done; } - count--; - label1++; - label2++; } if (cdiff != 0) { *orderp = cdiff; @@ -643,11 +647,12 @@ dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2, namereln = dns_namereln_subdomain; else namereln = dns_namereln_equal; + *nlabelsp = nlabels; + return (namereln); done: *nlabelsp = nlabels; - - if (nlabels > 0 && namereln == dns_namereln_none) + if (nlabels > 0) namereln = dns_namereln_commonancestor; return (namereln); @@ -696,7 +701,7 @@ dns_name_equal(const dns_name_t *name1, const dns_name_t *name2) { REQUIRE((name1->attributes & DNS_NAMEATTR_ABSOLUTE) == (name2->attributes & DNS_NAMEATTR_ABSOLUTE)); - if (name1 == name2) + if (ISC_UNLIKELY(name1 == name2)) return (ISC_TRUE); if (name1->length != name2->length) @@ -709,16 +714,32 @@ dns_name_equal(const dns_name_t *name1, const dns_name_t *name2) { label1 = name1->ndata; label2 = name2->ndata; - while (l > 0) { - l--; + while (ISC_LIKELY(l-- > 0)) { count = *label1++; if (count != *label2++) return (ISC_FALSE); INSIST(count <= 63); /* no bitstring support */ - while (count > 0) { - count--; + /* Loop unrolled for performance */ + while (ISC_LIKELY(count > 3)) { + c = maptolower[label1[0]]; + if (c != maptolower[label2[0]]) + return (ISC_FALSE); + c = maptolower[label1[1]]; + if (c != maptolower[label2[1]]) + return (ISC_FALSE); + c = maptolower[label1[2]]; + if (c != maptolower[label2[2]]) + return (ISC_FALSE); + c = maptolower[label1[3]]; + if (c != maptolower[label2[3]]) + return (ISC_FALSE); + count -= 4; + label1 += 4; + label2 += 4; + } + while (ISC_LIKELY(count-- > 0)) { c = maptolower[*label1++]; if (c != maptolower[*label2++]) return (ISC_FALSE); @@ -2574,3 +2595,87 @@ dns_name_isdnssd(const dns_name_t *name) { return (ISC_FALSE); } + +#define NS_NAME_INIT(A,B) \ + { \ + DNS_NAME_MAGIC, \ + A, sizeof(A), sizeof(B), \ + DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE, \ + B, NULL, { (void *)-1, (void *)-1}, \ + {NULL, NULL} \ + } + +static unsigned char inaddr10_offsets[] = { 0, 3, 11, 16 }; +static unsigned char inaddr172_offsets[] = { 0, 3, 7, 15, 20 }; +static unsigned char inaddr192_offsets[] = { 0, 4, 8, 16, 21 }; + +static unsigned char inaddr10[] = "\00210\007IN-ADDR\004ARPA"; + +static unsigned char inaddr16172[] = "\00216\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr17172[] = "\00217\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr18172[] = "\00218\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr19172[] = "\00219\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr20172[] = "\00220\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr21172[] = "\00221\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr22172[] = "\00222\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr23172[] = "\00223\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr24172[] = "\00224\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr25172[] = "\00225\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr26172[] = "\00226\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr27172[] = "\00227\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr28172[] = "\00228\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr29172[] = "\00229\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr30172[] = "\00230\003172\007IN-ADDR\004ARPA"; +static unsigned char inaddr31172[] = "\00231\003172\007IN-ADDR\004ARPA"; + +static unsigned char inaddr168192[] = "\003168\003192\007IN-ADDR\004ARPA"; + +static dns_name_t const rfc1918names[] = { + NS_NAME_INIT(inaddr10, inaddr10_offsets), + NS_NAME_INIT(inaddr16172, inaddr172_offsets), + NS_NAME_INIT(inaddr17172, inaddr172_offsets), + NS_NAME_INIT(inaddr18172, inaddr172_offsets), + NS_NAME_INIT(inaddr19172, inaddr172_offsets), + NS_NAME_INIT(inaddr20172, inaddr172_offsets), + NS_NAME_INIT(inaddr21172, inaddr172_offsets), + NS_NAME_INIT(inaddr22172, inaddr172_offsets), + NS_NAME_INIT(inaddr23172, inaddr172_offsets), + NS_NAME_INIT(inaddr24172, inaddr172_offsets), + NS_NAME_INIT(inaddr25172, inaddr172_offsets), + NS_NAME_INIT(inaddr26172, inaddr172_offsets), + NS_NAME_INIT(inaddr27172, inaddr172_offsets), + NS_NAME_INIT(inaddr28172, inaddr172_offsets), + NS_NAME_INIT(inaddr29172, inaddr172_offsets), + NS_NAME_INIT(inaddr30172, inaddr172_offsets), + NS_NAME_INIT(inaddr31172, inaddr172_offsets), + NS_NAME_INIT(inaddr168192, inaddr192_offsets) +}; + +isc_boolean_t +dns_name_isrfc1918(const dns_name_t *name) { + size_t i; + + for (i = 0; i < (sizeof(rfc1918names)/sizeof(*rfc1918names)); i++) + if (dns_name_issubdomain(name, &rfc1918names[i])) + return (ISC_TRUE); + return (ISC_FALSE); +} + +static unsigned char ulaoffsets[] = { 0, 2, 4, 8, 13 }; +static unsigned char ip6fc[] = "\001c\001f\003ip6\004ARPA"; +static unsigned char ip6fd[] = "\001d\001f\003ip6\004ARPA"; + +static dns_name_t const ulanames[] = { + NS_NAME_INIT(ip6fc, ulaoffsets), + NS_NAME_INIT(ip6fd, ulaoffsets), +}; + +isc_boolean_t +dns_name_isula(const dns_name_t *name) { + size_t i; + + for (i = 0; i < (sizeof(ulanames)/sizeof(*ulanames)); i++) + if (dns_name_issubdomain(name, &ulanames[i])) + return (ISC_TRUE); + return (ISC_FALSE); +} diff --git a/contrib/bind9/lib/dns/nsec3.c b/contrib/bind9/lib/dns/nsec3.c index 74ab9ddf6..3d4721711 100644 --- a/contrib/bind9/lib/dns/nsec3.c +++ b/contrib/bind9/lib/dns/nsec3.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2006, 2008-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2006, 2008-2016 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -1342,7 +1342,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name, CHECK(dns_db_createiterator(db, DNS_DB_NSEC3ONLY, &dbit)); result = dns_dbiterator_seek(dbit, hashname); - if (result == ISC_R_NOTFOUND) + if (result == ISC_R_NOTFOUND || result == DNS_R_PARTIALMATCH) goto success; if (result != ISC_R_SUCCESS) goto failure; @@ -1447,7 +1447,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name, &empty, origin, hash, iterations, salt, salt_length)); result = dns_dbiterator_seek(dbit, hashname); - if (result == ISC_R_NOTFOUND) + if (result == ISC_R_NOTFOUND || result == DNS_R_PARTIALMATCH) goto success; if (result != ISC_R_SUCCESS) goto failure; diff --git a/contrib/bind9/lib/dns/openssl_link.c b/contrib/bind9/lib/dns/openssl_link.c index 8683bee4d..1cb46172c 100644 --- a/contrib/bind9/lib/dns/openssl_link.c +++ b/contrib/bind9/lib/dns/openssl_link.c @@ -1,5 +1,5 @@ /* - * Portions Copyright (C) 2004-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") + * Portions Copyright (C) 2004-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC") * Portions Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -88,7 +88,7 @@ entropy_getpseudo(unsigned char *buf, int num) { return (result == ISC_R_SUCCESS ? 1 : -1); } -#if OPENSSL_VERSION_NUMBER < 0x10100000L +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) static void entropy_add(const void *buf, int num, double entropy) { /* @@ -121,7 +121,7 @@ lock_callback(int mode, int type, const char *file, int line) { UNLOCK(&locks[type]); } -#if OPENSSL_VERSION_NUMBER < 0x10100000L +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) static unsigned long id_callback(void) { return ((unsigned long)isc_thread_self()); @@ -187,7 +187,7 @@ dst__openssl_init(const char *engine) { if (result != ISC_R_SUCCESS) goto cleanup_mutexalloc; CRYPTO_set_locking_callback(lock_callback); -#if OPENSSL_VERSION_NUMBER < 0x10100000L +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) CRYPTO_set_id_callback(id_callback); #endif @@ -206,7 +206,20 @@ dst__openssl_init(const char *engine) { rm->status = entropy_status; #ifdef USE_ENGINE +#if !defined(CONF_MFLAGS_DEFAULT_SECTION) OPENSSL_config(NULL); +#else + /* + * OPENSSL_config() can only be called a single time as of + * 1.0.2e so do the steps individually. + */ + OPENSSL_load_builtin_modules(); + ENGINE_load_builtin_engines(); + ERR_clear_error(); + CONF_modules_load_file(NULL, NULL, + CONF_MFLAGS_DEFAULT_SECTION | + CONF_MFLAGS_IGNORE_MISSING_FILE); +#endif if (engine != NULL && *engine == '\0') engine = NULL; @@ -287,7 +300,7 @@ dst__openssl_destroy(void) { CRYPTO_cleanup_all_ex_data(); #endif ERR_clear_error(); -#if OPENSSL_VERSION_NUMBER < 0x10100000L +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) ERR_remove_state(0); #endif ERR_free_strings(); diff --git a/contrib/bind9/lib/dns/openssldh_link.c b/contrib/bind9/lib/dns/openssldh_link.c index 4d77c5bf1..44114b806 100644 --- a/contrib/bind9/lib/dns/openssldh_link.c +++ b/contrib/bind9/lib/dns/openssldh_link.c @@ -173,7 +173,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { DH *dh = NULL; #if OPENSSL_VERSION_NUMBER > 0x00908000L BN_GENCB *cb; -#if OPENSSL_VERSION_NUMBER < 0x10100000L +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) BN_GENCB _cb; #endif union { @@ -210,7 +210,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { if (dh == NULL) return (dst__openssl_toresult(ISC_R_NOMEMORY)); cb = BN_GENCB_new(); -#if OPENSSL_VERSION_NUMBER >= 0x10100000L +#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) if (cb == NULL) { DH_free(dh); return (dst__openssl_toresult(ISC_R_NOMEMORY)); @@ -617,7 +617,7 @@ BN_fromhex(BIGNUM *b, const char *str) { RUNTIME_CHECK(strlen(str) < 1024U && strlen(str) % 2 == 0U); for (i = 0; i < strlen(str); i += 2) { - char *s; + const char *s; unsigned int high, low; s = strchr(hexdigits, tolower((unsigned char)str[i])); diff --git a/contrib/bind9/lib/dns/openssldsa_link.c b/contrib/bind9/lib/dns/openssldsa_link.c index 34348f077..81a09cf2f 100644 --- a/contrib/bind9/lib/dns/openssldsa_link.c +++ b/contrib/bind9/lib/dns/openssldsa_link.c @@ -78,6 +78,8 @@ openssldsa_createctx(dst_key_t *key, dst_context_t *dctx) { UNUSED(key); sha1ctx = isc_mem_get(dctx->mctx, sizeof(isc_sha1_t)); + if (sha1ctx == NULL) + return (ISC_R_NOMEMORY); isc_sha1_init(sha1ctx); dctx->ctxdata.sha1ctx = sha1ctx; return (ISC_R_SUCCESS); @@ -359,7 +361,7 @@ openssldsa_generate(dst_key_t *key, int unused, void (*callback)(int)) { isc_result_t result; #if OPENSSL_VERSION_NUMBER > 0x00908000L BN_GENCB *cb; -#if OPENSSL_VERSION_NUMBER < 0x10100000L +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) BN_GENCB _cb; #endif union { @@ -383,7 +385,7 @@ openssldsa_generate(dst_key_t *key, int unused, void (*callback)(int)) { if (dsa == NULL) return (dst__openssl_toresult(DST_R_OPENSSLFAILURE)); cb = BN_GENCB_new(); -#if OPENSSL_VERSION_NUMBER >= 0x10100000L +#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) if (cb == NULL) { DSA_free(dsa); return (dst__openssl_toresult(DST_R_OPENSSLFAILURE)); diff --git a/contrib/bind9/lib/dns/opensslrsa_link.c b/contrib/bind9/lib/dns/opensslrsa_link.c index f78732d6d..03ea1bd6e 100644 --- a/contrib/bind9/lib/dns/opensslrsa_link.c +++ b/contrib/bind9/lib/dns/opensslrsa_link.c @@ -774,7 +774,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) { } u; RSA *rsa = RSA_new(); BIGNUM *e = BN_new(); -#if OPENSSL_VERSION_NUMBER < 0x10100000L +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) BN_GENCB _cb; #endif BN_GENCB *cb = BN_GENCB_new(); @@ -1393,8 +1393,7 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, UNUSED(pin); if (engine == NULL) { - colon = strchr(label, ':'); - if (colon == NULL) + if (strchr(label, ':') == NULL) DST_RET(DST_R_NOENGINE); tmpengine = isc_mem_strdup(key->mctx, label); if (tmpengine == NULL) diff --git a/contrib/bind9/lib/dns/rbt.c b/contrib/bind9/lib/dns/rbt.c index 74aad1b35..cf8cd91ca 100644 --- a/contrib/bind9/lib/dns/rbt.c +++ b/contrib/bind9/lib/dns/rbt.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007-2009, 2011-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007-2009, 2011-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -58,14 +58,14 @@ #endif struct dns_rbt { - unsigned int magic; - isc_mem_t * mctx; - dns_rbtnode_t * root; - void (*data_deleter)(void *, void *); - void * deleter_arg; - unsigned int nodecount; - unsigned int hashsize; - dns_rbtnode_t ** hashtable; + unsigned int magic; + isc_mem_t * mctx; + dns_rbtnode_t * root; + void (*data_deleter)(void *, void *); + void * deleter_arg; + unsigned int nodecount; + unsigned int hashsize; + dns_rbtnode_t ** hashtable; }; #define RED 0 @@ -78,6 +78,9 @@ struct dns_rbt { #define LEFT(node) ((node)->left) #define RIGHT(node) ((node)->right) #define DOWN(node) ((node)->down) +#ifdef DNS_RBT_USEHASH +#define UPPERNODE(node) ((node)->uppernode) +#endif /* DNS_RBT_USEHASH */ #define DATA(node) ((node)->data) #define HASHNEXT(node) ((node)->hashnext) #define HASHVAL(node) ((node)->hashval) @@ -174,25 +177,45 @@ Name(dns_rbtnode_t *node) { return (name); } +#endif /* DEBUG */ -static void dns_rbt_printnodename(dns_rbtnode_t *node); -#endif +#ifdef DNS_RBT_USEHASH + +/* + * Upper node is the parent of the root of the passed node's + * subtree. The passed node must not be NULL. + */ +static inline dns_rbtnode_t * +get_upper_node(dns_rbtnode_t *node) { + return (UPPERNODE(node)); +} + +#else + +/* The passed node must not be NULL. */ +static inline dns_rbtnode_t * +get_subtree_root(dns_rbtnode_t *node) { + while (!IS_ROOT(node)) { + node = PARENT(node); + } + + return (node); +} +/* Upper node is the parent of the root of the passed node's + * subtree. The passed node must not be NULL. + */ static inline dns_rbtnode_t * -find_up(dns_rbtnode_t *node) { +get_upper_node(dns_rbtnode_t *node) { dns_rbtnode_t *root; - /* - * Return the node in the level above the argument node that points - * to the level the argument node is in. If the argument node is in - * the top level, the return value is NULL. - */ - for (root = node; ! IS_ROOT(root); root = PARENT(root)) - ; /* Nothing. */ + root = get_subtree_root(node); return (PARENT(root)); } +#endif /* DNS_RBT_USEHASH */ + /* * Forward declarations. */ @@ -219,14 +242,14 @@ dns_rbt_addonlevel(dns_rbtnode_t *node, dns_rbtnode_t *current, int order, dns_rbtnode_t **rootp); static void -dns_rbt_deletefromlevel(dns_rbtnode_t *delete, dns_rbtnode_t **rootp); +deletefromlevel(dns_rbtnode_t *delete, dns_rbtnode_t **rootp); -static isc_result_t -dns_rbt_deletetree(dns_rbt_t *rbt, dns_rbtnode_t *node); +static void +deletetreeflat(dns_rbt_t *rbt, unsigned int quantum, isc_boolean_t unhash, + dns_rbtnode_t **nodep); static void -dns_rbt_deletetreeflat(dns_rbt_t *rbt, unsigned int quantum, - dns_rbtnode_t **nodep); +freenode(dns_rbt_t *rbt, dns_rbtnode_t **nodep); /* * Initialize a red/black tree of trees. @@ -289,7 +312,7 @@ dns_rbt_destroy2(dns_rbt_t **rbtp, unsigned int quantum) { rbt = *rbtp; - dns_rbt_deletetreeflat(rbt, quantum, &rbt->root); + deletetreeflat(rbt, quantum, ISC_FALSE, &rbt->root); if (rbt->root != NULL) return (ISC_R_QUOTA); @@ -377,7 +400,7 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) { dns_offsets_t current_offsets; dns_namereln_t compared; isc_result_t result = ISC_R_SUCCESS; - dns_rbtnodechain_t chain; + unsigned int level_count; unsigned int common_labels; unsigned int nlabels, hlabels; int order; @@ -386,6 +409,37 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) { REQUIRE(dns_name_isabsolute(name)); REQUIRE(nodep != NULL && *nodep == NULL); + /* + * Dear future BIND developer, + * + * After you have tried attempting to optimize this routine by + * using the hashtable and have realized your folly, please + * append another cross ("X") below as a warning to the next + * future BIND developer: + * + * Number of victim developers: X + * + * I wish the past developer had included such a notice. + * + * Long form: Unlike dns_rbt_findnode(), this function does not + * lend itself to be optimized using the hashtable: + * + * 1. In the subtree where the insertion occurs, this function + * needs to have the insertion point and the order where the + * lookup terminated (i.e., at the insertion point where left or + * right child is NULL). This cannot be determined from the + * hashtable, so at least in that subtree, a BST O(log N) lookup + * is necessary. + * + * 2. Our RBT nodes contain not only single labels but label + * sequences to optimize space usage. So at every level, we have + * to look for a match in the hashtable for all superdomains in + * the rest of the name we're searching. This is an O(N) + * operation at least, here N being the label size of name, each + * of which is a hashtable lookup involving dns_name_equal() + * comparisons. + */ + /* * Create a copy of the name so the original name structure is * not modified. @@ -394,11 +448,14 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) { add_name = dns_fixedname_name(&fixedcopy); dns_name_clone(name, add_name); - if (rbt->root == NULL) { + if (ISC_UNLIKELY(rbt->root == NULL)) { result = create_node(rbt->mctx, add_name, &new_current); if (result == ISC_R_SUCCESS) { rbt->nodecount++; new_current->is_root = 1; +#ifdef DNS_RBT_USEHASH + UPPERNODE(new_current) = NULL; +#endif /* DNS_RBT_USEHASH */ rbt->root = new_current; *nodep = new_current; hash_node(rbt, new_current, name); @@ -406,7 +463,7 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) { return (result); } - dns_rbtnodechain_init(&chain, rbt->mctx); + level_count = 0; dns_fixedname_init(&fixedprefix); dns_fixedname_init(&fixedsuffix); @@ -485,8 +542,9 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) { parent = NULL; child = DOWN(current); - ADD_LEVEL(&chain, current); + INSIST(level_count < DNS_RBT_LEVELBLOCK); + level_count++; } else { /* * The number of labels in common is fewer @@ -513,9 +571,7 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) { * a simple integer variable, but I am pressed * for time. */ - if (chain.level_count == - (sizeof(chain.levels) / - sizeof(*chain.levels))) { + if (level_count >= DNS_RBT_LEVELBLOCK) { result = ISC_R_NOSPACE; break; } @@ -578,8 +634,13 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) { PARENT(current) = new_current; DOWN(new_current) = current; root = &DOWN(new_current); +#ifdef DNS_RBT_USEHASH + UPPERNODE(new_current) = UPPERNODE(current); + UPPERNODE(current) = new_current; +#endif /* DNS_RBT_USEHASH */ - ADD_LEVEL(&chain, new_current); + INSIST(level_count < DNS_RBT_LEVELBLOCK); + level_count++; LEFT(current) = NULL; RIGHT(current) = NULL; @@ -629,12 +690,18 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) { } - } while (child != NULL); + } while (ISC_LIKELY(child != NULL)); - if (result == ISC_R_SUCCESS) + if (ISC_LIKELY(result == ISC_R_SUCCESS)) result = create_node(rbt->mctx, add_name, &new_current); - if (result == ISC_R_SUCCESS) { + if (ISC_LIKELY(result == ISC_R_SUCCESS)) { +#ifdef DNS_RBT_USEHASH + if (*root == NULL) + UPPERNODE(new_current) = current; + else + UPPERNODE(new_current) = PARENT(*root); +#endif /* DNS_RBT_USEHASH */ dns_rbt_addonlevel(new_current, current, order, root); rbt->nodecount++; *nodep = new_current; @@ -683,7 +750,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname, unsigned int options, dns_rbtfindcallback_t callback, void *callback_arg) { - dns_rbtnode_t *current, *last_compared, *current_root; + dns_rbtnode_t *current, *last_compared; dns_rbtnodechain_t localchain; dns_name_t *search_name, current_name, *callback_name; dns_fixedname_t fixedcallbackname, fixedsearchname; @@ -711,7 +778,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname, } else dns_rbtnodechain_reset(chain); - if (rbt->root == NULL) + if (ISC_UNLIKELY(rbt->root == NULL)) return (ISC_R_NOTFOUND); else { /* @@ -741,9 +808,8 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname, saved_result = ISC_R_SUCCESS; current = rbt->root; - current_root = rbt->root; - while (current != NULL) { + while (ISC_LIKELY(current != NULL)) { NODENAME(current, ¤t_name); compared = dns_name_fullcompare(search_name, ¤t_name, &order, &common_labels); @@ -762,28 +828,23 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname, unsigned int hash; /* - * If there is no hash table, hashing can't be done. - */ - if (rbt->hashtable == NULL) - goto nohash; - - /* - * The case of current != current_root, that - * means a left or right pointer was followed, - * only happens when the algorithm fell through to - * the traditional binary search because of a - * bitstring label. Since we dropped the bitstring - * support, this should not happen. + * The case of current not being a subtree root, + * that means a left or right pointer was + * followed, only happens when the algorithm + * fell through to the traditional binary search + * because of a bitstring label. Since we + * dropped the bitstring support, this should + * not happen. */ - INSIST(current == current_root); + INSIST(IS_ROOT(current)); nlabels = dns_name_countlabels(search_name); /* - * current_root is the root of the current level, so - * it's parent is the same as it's "up" pointer. + * current is the root of the current level, so + * its parent is the same as its "up" pointer. */ - up_current = PARENT(current_root); + up_current = PARENT(current); dns_name_init(&hash_name, NULL); hashagain: @@ -805,13 +866,20 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname, { dns_name_t hnode_name; - if (hash != HASHVAL(hnode)) + if (ISC_LIKELY(hash != HASHVAL(hnode))) continue; - if (find_up(hnode) != up_current) + /* + * This checks that the hashed label + * sequence being looked up is at the + * same tree level, so that we don't + * match a labelsequence from some other + * subdomain. + */ + if (ISC_LIKELY(get_upper_node(hnode) != up_current)) continue; dns_name_init(&hnode_name, NULL); NODENAME(hnode, &hnode_name); - if (dns_name_equal(&hnode_name, &hash_name)) + if (ISC_LIKELY(dns_name_equal(&hnode_name, &hash_name))) break; } @@ -848,8 +916,8 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname, current = NULL; continue; - nohash: -#endif /* DNS_RBT_USEHASH */ +#else /* DNS_RBT_USEHASH */ + /* * Standard binary search tree movement. */ @@ -858,6 +926,8 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname, else current = RIGHT(current); +#endif /* DNS_RBT_USEHASH */ + } else { /* * The names have some common suffix labels. @@ -930,8 +1000,6 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname, * Finally, head to the next tree level. */ current = DOWN(current); - current_root = current; - } else { /* * Though there are labels in common, the @@ -1285,10 +1353,10 @@ dns_rbt_deletenode(dns_rbt_t *rbt, dns_rbtnode_t *node, isc_boolean_t recurse) REQUIRE(DNS_RBTNODE_VALID(node)); if (DOWN(node) != NULL) { - if (recurse) - RUNTIME_CHECK(dns_rbt_deletetree(rbt, DOWN(node)) - == ISC_R_SUCCESS); - else { + if (recurse) { + PARENT(DOWN(node)) = NULL; + deletetreeflat(rbt, 0, ISC_TRUE, &DOWN(node)); + } else { if (DATA(node) != NULL && rbt->data_deleter != NULL) rbt->data_deleter(DATA(node), rbt->deleter_arg); DATA(node) = NULL; @@ -1300,25 +1368,24 @@ dns_rbt_deletenode(dns_rbt_t *rbt, dns_rbtnode_t *node, isc_boolean_t recurse) * by itself on a single level, so join_nodes() could * be used to collapse the tree (with all the caveats * of the comment at the start of this function). + * But join_nodes() function has now been removed. */ return (ISC_R_SUCCESS); } } /* - * Note the node that points to the level of the node that is being - * deleted. If the deleted node is the top level, parent will be set - * to NULL. + * Note the node that points to the level of the node + * that is being deleted. If the deleted node is the + * top level, parent will be set to NULL. */ - parent = find_up(node); + parent = get_upper_node(node); /* - * This node now has no down pointer (either because it didn't - * have one to start, or because it was recursively removed). - * So now the node needs to be removed from this level. + * This node now has no down pointer, so now it needs + * to be removed from this level. */ - dns_rbt_deletefromlevel(node, parent == NULL ? &rbt->root : - &DOWN(parent)); + deletefromlevel(node, parent == NULL ? &rbt->root : &DOWN(parent)); if (DATA(node) != NULL && rbt->data_deleter != NULL) rbt->data_deleter(DATA(node), rbt->deleter_arg); @@ -1328,31 +1395,8 @@ dns_rbt_deletenode(dns_rbt_t *rbt, dns_rbtnode_t *node, isc_boolean_t recurse) node->magic = 0; #endif dns_rbtnode_refdestroy(node); - isc_mem_put(rbt->mctx, node, NODE_SIZE(node)); - rbt->nodecount--; - /* - * There are now two special cases that can exist that would - * not have existed if the tree had been created using only - * the names that now exist in it. (This is all related to - * join_nodes() as described in this function's introductory comment.) - * Both cases exist when the deleted node's parent (the node - * that pointed to the deleted node's level) is not null but - * it has no data: parent != NULL && DATA(parent) == NULL. - * - * The first case is that the deleted node was the last on its level: - * DOWN(parent) == NULL. This case can only exist if the parent was - * previously deleted -- and so now, apparently, the parent should go - * away. That can't be done though because there might be external - * references to it, such as through a nodechain. - * - * The other case also involves a parent with no data, but with the - * deleted node being the next-to-last node instead of the last: - * LEFT(DOWN(parent)) == NULL && RIGHT(DOWN(parent)) == NULL. - * Presumably now the remaining node on the level should be joined - * with the parent, but it's already been described why that can't be - * done. - */ + freenode(rbt, &node); /* * This function never fails. @@ -1391,7 +1435,7 @@ dns_rbt_fullnamefromnode(dns_rbtnode_t *node, dns_name_t *name) { if (result != ISC_R_SUCCESS) break; - node = find_up(node); + node = get_upper_node(node); } while (! dns_name_isabsolute(name)); return (result); @@ -1511,7 +1555,7 @@ inithash(dns_rbt_t *rbt) { unsigned int bytes; rbt->hashsize = RBT_HASH_SIZE; - bytes = rbt->hashsize * sizeof(dns_rbtnode_t *); + bytes = (unsigned int)rbt->hashsize * sizeof(dns_rbtnode_t *); rbt->hashtable = isc_mem_get(rbt->mctx, bytes); if (rbt->hashtable == NULL) @@ -1527,10 +1571,11 @@ rehash(dns_rbt_t *rbt) { unsigned int oldsize; dns_rbtnode_t **oldtable; dns_rbtnode_t *node; + dns_rbtnode_t *nextnode; unsigned int hash; unsigned int i; - oldsize = rbt->hashsize; + oldsize = (unsigned int)rbt->hashsize; oldtable = rbt->hashtable; rbt->hashsize = rbt->hashsize * 2 + 1; rbt->hashtable = isc_mem_get(rbt->mctx, @@ -1541,19 +1586,15 @@ rehash(dns_rbt_t *rbt) { return; } - INSIST(rbt->hashsize > 0); - for (i = 0; i < rbt->hashsize; i++) rbt->hashtable[i] = NULL; for (i = 0; i < oldsize; i++) { - node = oldtable[i]; - while (node != NULL) { + for (node = oldtable[i]; node != NULL; node = nextnode) { hash = HASHVAL(node) % rbt->hashsize; - oldtable[i] = HASHNEXT(node); + nextnode = HASHNEXT(node); HASHNEXT(node) = rbt->hashtable[hash]; rbt->hashtable[hash] = node; - node = oldtable[i]; } } @@ -1578,19 +1619,17 @@ unhash_node(dns_rbt_t *rbt, dns_rbtnode_t *node) { REQUIRE(DNS_RBTNODE_VALID(node)); - if (rbt->hashtable != NULL) { - bucket = HASHVAL(node) % rbt->hashsize; - bucket_node = rbt->hashtable[bucket]; + bucket = HASHVAL(node) % rbt->hashsize; + bucket_node = rbt->hashtable[bucket]; - if (bucket_node == node) - rbt->hashtable[bucket] = HASHNEXT(node); - else { - while (HASHNEXT(bucket_node) != node) { - INSIST(HASHNEXT(bucket_node) != NULL); - bucket_node = HASHNEXT(bucket_node); - } - HASHNEXT(bucket_node) = HASHNEXT(node); + if (bucket_node == node) { + rbt->hashtable[bucket] = HASHNEXT(node); + } else { + while (HASHNEXT(bucket_node) != node) { + INSIST(HASHNEXT(bucket_node) != NULL); + bucket_node = HASHNEXT(bucket_node); } + HASHNEXT(bucket_node) = HASHNEXT(node); } } #endif /* DNS_RBT_USEHASH */ @@ -1771,7 +1810,7 @@ dns_rbt_addonlevel(dns_rbtnode_t *node, dns_rbtnode_t *current, int order, * true red/black tree on a single level. */ static void -dns_rbt_deletefromlevel(dns_rbtnode_t *delete, dns_rbtnode_t **rootp) { +deletefromlevel(dns_rbtnode_t *delete, dns_rbtnode_t **rootp) { dns_rbtnode_t *child, *sibling, *parent; dns_rbtnode_t *successor; @@ -2004,117 +2043,66 @@ dns_rbt_deletefromlevel(dns_rbtnode_t *delete, dns_rbtnode_t **rootp) { } } -/* - * This should only be used on the root of a tree, because no color fixup - * is done at all. - * - * NOTE: No root pointer maintenance is done, because the function is only - * used for two cases: - * + deleting everything DOWN from a node that is itself being deleted, and - * + deleting the entire tree of trees from dns_rbt_destroy. - * In each case, the root pointer is no longer relevant, so there - * is no need for a root parameter to this function. - * - * If the function is ever intended to be used to delete something where - * a pointer needs to be told that this tree no longer exists, - * this function would need to adjusted accordingly. - */ -static isc_result_t -dns_rbt_deletetree(dns_rbt_t *rbt, dns_rbtnode_t *node) { - isc_result_t result = ISC_R_SUCCESS; - REQUIRE(VALID_RBT(rbt)); - - if (node == NULL) - return (result); - - if (LEFT(node) != NULL) { - result = dns_rbt_deletetree(rbt, LEFT(node)); - if (result != ISC_R_SUCCESS) - goto done; - LEFT(node) = NULL; - } - if (RIGHT(node) != NULL) { - result = dns_rbt_deletetree(rbt, RIGHT(node)); - if (result != ISC_R_SUCCESS) - goto done; - RIGHT(node) = NULL; - } - if (DOWN(node) != NULL) { - result = dns_rbt_deletetree(rbt, DOWN(node)); - if (result != ISC_R_SUCCESS) - goto done; - DOWN(node) = NULL; - } - done: - if (result != ISC_R_SUCCESS) - return (result); - - if (DATA(node) != NULL && rbt->data_deleter != NULL) - rbt->data_deleter(DATA(node), rbt->deleter_arg); - - unhash_node(rbt, node); -#if DNS_RBT_USEMAGIC - node->magic = 0; -#endif +static void +freenode(dns_rbt_t *rbt, dns_rbtnode_t **nodep) { + dns_rbtnode_t *node = *nodep; isc_mem_put(rbt->mctx, node, NODE_SIZE(node)); + *nodep = NULL; + rbt->nodecount--; - return (result); } static void -dns_rbt_deletetreeflat(dns_rbt_t *rbt, unsigned int quantum, - dns_rbtnode_t **nodep) +deletetreeflat(dns_rbt_t *rbt, unsigned int quantum, isc_boolean_t unhash, + dns_rbtnode_t **nodep) { - dns_rbtnode_t *parent; - dns_rbtnode_t *node = *nodep; - REQUIRE(VALID_RBT(rbt)); - - again: - if (node == NULL) { - *nodep = NULL; - return; - } - - traverse: - if (LEFT(node) != NULL) { - node = LEFT(node); - goto traverse; - } - if (DOWN(node) != NULL) { - node = DOWN(node); - goto traverse; - } + dns_rbtnode_t *root = *nodep; - if (DATA(node) != NULL && rbt->data_deleter != NULL) - rbt->data_deleter(DATA(node), rbt->deleter_arg); + while (root != NULL) { + /* + * If there is a left, right or down node, walk into it + * and iterate. + */ + if (LEFT(root) != NULL) { + dns_rbtnode_t *node = root; + root = LEFT(root); + LEFT(node) = NULL; + } else if (RIGHT(root) != NULL) { + dns_rbtnode_t *node = root; + root = RIGHT(root); + RIGHT(node) = NULL; + } else if (DOWN(root) != NULL) { + dns_rbtnode_t *node = root; + root = DOWN(root); + DOWN(node) = NULL; + } else { + /* + * There are no left, right or down nodes, so we + * can free this one and go back to its parent. + */ + dns_rbtnode_t *node = root; + root = PARENT(root); - /* - * Note: we don't call unhash_node() here as we are destroying - * the complete rbt tree. - */ + if (DATA(node) != NULL && rbt->data_deleter != NULL) + rbt->data_deleter(DATA(node), + rbt->deleter_arg); + if (unhash) + unhash_node(rbt, node); + /* + * Note: we don't call unhash_node() here as we + * are destroying the complete RBT tree. + */ #if DNS_RBT_USEMAGIC - node->magic = 0; + node->magic = 0; #endif - parent = PARENT(node); - if (RIGHT(node) != NULL) - PARENT(RIGHT(node)) = parent; - if (parent != NULL) { - if (LEFT(parent) == node) - LEFT(parent) = RIGHT(node); - else if (DOWN(parent) == node) - DOWN(parent) = RIGHT(node); - } else - parent = RIGHT(node); - - isc_mem_put(rbt->mctx, node, NODE_SIZE(node)); - rbt->nodecount--; - node = parent; - if (quantum != 0 && --quantum == 0) { - *nodep = node; - return; + freenode(rbt, &node); + if (quantum != 0 && --quantum == 0) + break; + } } - goto again; + + *nodep = root; } static void diff --git a/contrib/bind9/lib/dns/rbtdb.c b/contrib/bind9/lib/dns/rbtdb.c index a0fa148cf..82499d85c 100644 --- a/contrib/bind9/lib/dns/rbtdb.c +++ b/contrib/bind9/lib/dns/rbtdb.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -401,6 +401,9 @@ typedef ISC_LIST(dns_rbtnode_t) rbtnodelist_t; #define RDATASET_ATTR_STATCOUNT 0x0040 #define RDATASET_ATTR_OPTOUT 0x0080 #define RDATASET_ATTR_NEGATIVE 0x0100 +#define RDATASET_ATTR_PREFETCH 0x0200 +#define RDATASET_ATTR_CASESET 0x0400 +#define RDATASET_ATTR_ZEROTTL 0x0800 typedef struct acache_cbarg { dns_rdatasetadditional_t type; @@ -441,6 +444,16 @@ struct acachectl { (((header)->attributes & RDATASET_ATTR_OPTOUT) != 0) #define NEGATIVE(header) \ (((header)->attributes & RDATASET_ATTR_NEGATIVE) != 0) +#define PREFETCH(header) \ + (((header)->attributes & RDATASET_ATTR_PREFETCH) != 0) +#define CASESET(header) \ + (((header)->attributes & RDATASET_ATTR_CASESET) != 0) +#define ZEROTTL(header) \ + (((header)->attributes & RDATASET_ATTR_ZEROTTL) != 0) + +#define ACTIVE(header, now) \ + (((header)->rdh_ttl > (now)) || \ + ((header)->rdh_ttl == (now) && ZEROTTL(header))) #define DEFAULT_NODE_LOCK_COUNT 7 /*%< Should be prime. */ @@ -1637,6 +1650,19 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) INSIST(!ISC_LINK_LINKED(node, deadlink)); + if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(1))) { + char printname[DNS_NAME_FORMATSIZE]; + isc_log_write(dns_lctx, + DNS_LOGCATEGORY_DATABASE, + DNS_LOGMODULE_CACHE, + ISC_LOG_DEBUG(1), + "delete_node(): %p %s (bucket %d)", + node, + dns_rbt_formatnodename(node, + printname, sizeof(printname)), + node->locknum); + } + switch (node->nsec) { case DNS_RBT_NSEC_NORMAL: #ifdef BIND9 @@ -1704,6 +1730,24 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) } } +/* + * Caller must be holding the node lock. + */ +static inline void +new_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) { + unsigned int lockrefs, noderefs; + isc_refcount_t *lockref; + + INSIST(!ISC_LINK_LINKED(node, deadlink)); + dns_rbtnode_refincrement0(node, &noderefs); + if (noderefs == 1) { /* this is the first reference to the node */ + lockref = &rbtdb->node_locks[node->locknum].references; + isc_refcount_increment0(lockref, &lockrefs); + INSIST(lockrefs != 0); + } + INSIST(noderefs != 0); +} + /*% * Clean up dead nodes. These are nodes which have no references, and * have no data. They are dead but we could not or chose not to delete @@ -1728,31 +1772,35 @@ cleanup_dead_nodes(dns_rbtdb_t *rbtdb, int bucketnum) { INSIST(dns_rbtnode_refcurrent(node) == 0 && node->data == NULL); - delete_node(rbtdb, node); + if (node->parent != NULL && + node->parent->down == node && node->left == NULL && + node->right == NULL && rbtdb->task != NULL) + { + isc_event_t *ev; + dns_db_t *db; + ev = isc_event_allocate(rbtdb->common.mctx, NULL, + DNS_EVENT_RBTPRUNE, + prune_tree, node, + sizeof(isc_event_t)); + if (ev != NULL) { + new_reference(rbtdb, node); + db = NULL; + attach((dns_db_t *)rbtdb, &db); + ev->ev_sender = db; + isc_task_send(rbtdb->task, &ev); + } else { + ISC_LIST_APPEND(rbtdb->deadnodes[bucketnum], + node, deadlink); + } + } else { + delete_node(rbtdb, node); + } node = ISC_LIST_HEAD(rbtdb->deadnodes[bucketnum]); count--; } } -/* - * Caller must be holding the node lock. - */ -static inline void -new_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) { - unsigned int lockrefs, noderefs; - isc_refcount_t *lockref; - - INSIST(!ISC_LINK_LINKED(node, deadlink)); - dns_rbtnode_refincrement0(node, &noderefs); - if (noderefs == 1) { /* this is the first reference to the node */ - lockref = &rbtdb->node_locks[node->locknum].references; - isc_refcount_increment0(lockref, &lockrefs); - INSIST(lockrefs != 0); - } - INSIST(noderefs != 0); -} - /* * This function is assumed to be called when a node is newly referenced * and can be in the deadnode list. In that case the node must be retrieved @@ -1969,21 +2017,6 @@ decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, deadlink); } } else { - if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(1))) { - char printname[DNS_NAME_FORMATSIZE]; - - isc_log_write(dns_lctx, - DNS_LOGCATEGORY_DATABASE, - DNS_LOGMODULE_CACHE, - ISC_LOG_DEBUG(1), - "decrement_reference: " - "delete from rbt: %p %s", - node, - dns_rbt_formatnodename(node, - printname, - sizeof(printname))); - } - delete_node(rbtdb, node); } } else { @@ -4305,7 +4338,7 @@ cache_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) { header_prev = NULL; for (header = node->data; header != NULL; header = header_next) { header_next = header->next; - if (header->rdh_ttl < search->now) { + if (!ACTIVE(header, search->now)) { /* * This rdataset is stale. If no one else is * using the node, we can clean it up right @@ -4313,7 +4346,7 @@ cache_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) { * the node as dirty, so it will get cleaned * up later. */ - if ((header->rdh_ttl < search->now - RBTDB_VIRTUAL) && + if ((header->rdh_ttl < search->now - RBTDB_VIRTUAL) && (locktype == isc_rwlocktype_write || NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) { /* @@ -4429,7 +4462,7 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node, header != NULL; header = header_next) { header_next = header->next; - if (header->rdh_ttl < search->now) { + if (!ACTIVE(header, search->now)) { /* * This rdataset is stale. If no one else is * using the node, we can clean it up right @@ -4437,7 +4470,7 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node, * the node as dirty, so it will get cleaned * up later. */ - if ((header->rdh_ttl < search->now - + if ((header->rdh_ttl < search->now - RBTDB_VIRTUAL) && (locktype == isc_rwlocktype_write || NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) { @@ -4606,7 +4639,7 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep, header != NULL; header = header_next) { header_next = header->next; - if (header->rdh_ttl < now) { + if (!ACTIVE(header, now)) { /* * This rdataset is stale. If no one else is * using the node, we can clean it up right @@ -4614,7 +4647,7 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep, * node as dirty, so it will get cleaned up * later. */ - if ((header->rdh_ttl < now - RBTDB_VIRTUAL) && + if ((header->rdh_ttl < now - RBTDB_VIRTUAL) && (locktype == isc_rwlocktype_write || NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) { /* @@ -5013,14 +5046,14 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, header_prev = NULL; for (header = node->data; header != NULL; header = header_next) { header_next = header->next; - if (header->rdh_ttl < now) { + if (!ACTIVE(header, now)) { /* * This rdataset is stale. If no one else is using the * node, we can clean it up right now, otherwise we * mark it as stale, and the node as dirty, so it will * get cleaned up later. */ - if ((header->rdh_ttl < now - RBTDB_VIRTUAL) && + if ((header->rdh_ttl < now - RBTDB_VIRTUAL) && (locktype == isc_rwlocktype_write || NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) { /* @@ -5320,7 +5353,7 @@ cache_findzonecut(dns_db_t *db, dns_name_t *name, unsigned int options, header_prev = NULL; for (header = node->data; header != NULL; header = header_next) { header_next = header->next; - if (header->rdh_ttl < now) { + if (!ACTIVE(header, now)) { /* * This rdataset is stale. If no one else is using the * node, we can clean it up right now, otherwise we @@ -5809,7 +5842,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, for (header = rbtnode->data; header != NULL; header = header_next) { header_next = header->next; - if (header->rdh_ttl < now) { + if (!ACTIVE(header, now)) { if ((header->rdh_ttl < now - RBTDB_VIRTUAL) && (locktype == isc_rwlocktype_write || NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) { @@ -6134,7 +6167,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, } } if (topheader != NULL && EXISTS(topheader) && - topheader->rdh_ttl >= now) { + ACTIVE(topheader, now)) { /* * Found one. */ @@ -6200,7 +6233,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, * has no effect, provided that the cache data isn't stale. */ if (rbtversion == NULL && trust < header->trust && - (header->rdh_ttl >= now || header_nx)) { + (ACTIVE(header, now) || header_nx)) { free_rdataset(rbtdb, rbtdb->common.mctx, newheader); if (addedrdataset != NULL) bind_rdataset(rbtdb, rbtnode, header, now, @@ -6270,7 +6303,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, * Don't lower trust of existing record if the * update is forced. */ - if (IS_CACHE(rbtdb) && header->rdh_ttl >= now && + if (IS_CACHE(rbtdb) && ACTIVE(header, now) && header->type == dns_rdatatype_ns && !header_nx && !newheader_nx && header->trust >= newheader->trust && @@ -6306,7 +6339,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, * to be no more than the current NS RRset's TTL. This * ensures the delegations that are withdrawn are honoured. */ - if (IS_CACHE(rbtdb) && header->rdh_ttl >= now && + if (IS_CACHE(rbtdb) && ACTIVE(header, now) && header->type == dns_rdatatype_ns && !header_nx && !newheader_nx && header->trust <= newheader->trust) { @@ -6314,7 +6347,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, newheader->rdh_ttl = header->rdh_ttl; } } - if (IS_CACHE(rbtdb) && header->rdh_ttl >= now && + if (IS_CACHE(rbtdb) && ACTIVE(header, now) && (header->type == dns_rdatatype_a || header->type == dns_rdatatype_aaaa || header->type == dns_rdatatype_ds || @@ -6646,6 +6679,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, newheader->type = RBTDB_RDATATYPE_VALUE(rdataset->type, rdataset->covers); newheader->attributes = 0; + if (rdataset->ttl == 0U) + newheader->attributes |= RDATASET_ATTR_ZEROTTL; newheader->noqname = NULL; newheader->closest = NULL; newheader->count = init_count++; @@ -7130,13 +7165,14 @@ loading_addrdataset(void *arg, dns_name_t *name, dns_rdataset_t *rdataset) { isc_region_t region; rdatasetheader_t *newheader; + REQUIRE(rdataset->rdclass == rbtdb->common.rdclass); + /* * This routine does no node locking. See comments in * 'load' below for more information on loading and * locking. */ - /* * SOA records are only allowed at top of zone. */ @@ -8615,6 +8651,8 @@ dbiterator_first(dns_dbiterator_t *iterator) { dns_name_t *name, *origin; if (rbtdbiter->result != ISC_R_SUCCESS && + rbtdbiter->result != ISC_R_NOTFOUND && + rbtdbiter->result != DNS_R_PARTIALMATCH && rbtdbiter->result != ISC_R_NOMORE) return (rbtdbiter->result); @@ -8668,6 +8706,8 @@ dbiterator_last(dns_dbiterator_t *iterator) { dns_name_t *name, *origin; if (rbtdbiter->result != ISC_R_SUCCESS && + rbtdbiter->result != ISC_R_NOTFOUND && + rbtdbiter->result != DNS_R_PARTIALMATCH && rbtdbiter->result != ISC_R_NOMORE) return (rbtdbiter->result); @@ -8718,6 +8758,7 @@ dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name) { if (rbtdbiter->result != ISC_R_SUCCESS && rbtdbiter->result != ISC_R_NOTFOUND && + rbtdbiter->result != DNS_R_PARTIALMATCH && rbtdbiter->result != ISC_R_NOMORE) return (rbtdbiter->result); @@ -8766,23 +8807,7 @@ dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name) { } } -#if 1 - if (result == ISC_R_SUCCESS) { - result = dns_rbtnodechain_current(rbtdbiter->current, iname, - origin, NULL); - if (result == ISC_R_SUCCESS) { - rbtdbiter->new_origin = ISC_TRUE; - reference_iter_node(rbtdbiter); - } - } else if (result == DNS_R_PARTIALMATCH) { - result = ISC_R_NOTFOUND; - rbtdbiter->node = NULL; - } - - rbtdbiter->result = result; -#else if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { - isc_result_t tresult; tresult = dns_rbtnodechain_current(rbtdbiter->current, iname, origin, NULL); if (tresult == ISC_R_SUCCESS) { @@ -8797,7 +8822,6 @@ dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name) { rbtdbiter->result = (result == DNS_R_PARTIALMATCH) ? ISC_R_SUCCESS : result; -#endif return (result); } @@ -8960,6 +8984,8 @@ dbiterator_pause(dns_dbiterator_t *iterator) { rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator; if (rbtdbiter->result != ISC_R_SUCCESS && + rbtdbiter->result != ISC_R_NOTFOUND && + rbtdbiter->result != DNS_R_PARTIALMATCH && rbtdbiter->result != ISC_R_NOMORE) return (rbtdbiter->result); diff --git a/contrib/bind9/lib/dns/rcode.c b/contrib/bind9/lib/dns/rcode.c index 2fdb751e6..1f97ad037 100644 --- a/contrib/bind9/lib/dns/rcode.c +++ b/contrib/bind9/lib/dns/rcode.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -49,6 +49,8 @@ #define NUMBERSIZE sizeof("037777777777") /* 2^32-1 octal + NUL */ +#define TOTEXTONLY 0x01 + #define RCODENAMES \ /* standard rcodes */ \ { dns_rcode_noerror, "NOERROR", 0}, \ @@ -61,7 +63,12 @@ { dns_rcode_yxrrset, "YXRRSET", 0}, \ { dns_rcode_nxrrset, "NXRRSET", 0}, \ { dns_rcode_notauth, "NOTAUTH", 0}, \ - { dns_rcode_notzone, "NOTZONE", 0}, + { dns_rcode_notzone, "NOTZONE", 0}, \ + { 11, "RESERVED11", TOTEXTONLY}, \ + { 12, "RESERVED12", TOTEXTONLY}, \ + { 13, "RESERVED13", TOTEXTONLY}, \ + { 14, "RESERVED14", TOTEXTONLY}, \ + { 15, "RESERVED15", TOTEXTONLY}, #define ERCODENAMES \ /* extended rcodes */ \ @@ -247,6 +254,7 @@ dns_mnemonic_fromtext(unsigned int *valuep, isc_textregion_t *source, unsigned int n; n = strlen(table[i].name); if (n == source->length && + (table[i].flags & TOTEXTONLY) == 0 && strncasecmp(source->base, table[i].name, n) == 0) { *valuep = table[i].value; return (ISC_R_SUCCESS); diff --git a/contrib/bind9/lib/dns/rdata.c b/contrib/bind9/lib/dns/rdata.c index 6c0a31953..2788cba9a 100644 --- a/contrib/bind9/lib/dns/rdata.c +++ b/contrib/bind9/lib/dns/rdata.c @@ -218,6 +218,84 @@ static isc_result_t unknown_totext(dns_rdata_t *rdata, dns_rdata_textctx_t *tctx, isc_buffer_t *target); +static inline isc_result_t +generic_fromtext_key(ARGS_FROMTEXT); + +static inline isc_result_t +generic_totext_key(ARGS_TOTEXT); + +static inline isc_result_t +generic_fromwire_key(ARGS_FROMWIRE); + +static inline isc_result_t +generic_fromstruct_key(ARGS_FROMSTRUCT); + +static inline isc_result_t +generic_tostruct_key(ARGS_TOSTRUCT); + +static inline void +generic_freestruct_key(ARGS_FREESTRUCT); + +static isc_result_t +generic_fromtext_txt(ARGS_FROMTEXT); + +static isc_result_t +generic_totext_txt(ARGS_TOTEXT); + +static isc_result_t +generic_fromwire_txt(ARGS_FROMWIRE); + +static isc_result_t +generic_fromstruct_txt(ARGS_FROMSTRUCT); + +static isc_result_t +generic_tostruct_txt(ARGS_TOSTRUCT); + +static void +generic_freestruct_txt(ARGS_FREESTRUCT); + +static isc_result_t +generic_txt_first(dns_rdata_txt_t *txt); + +static isc_result_t +generic_txt_next(dns_rdata_txt_t *txt); + +static isc_result_t +generic_txt_current(dns_rdata_txt_t *txt, dns_rdata_txt_string_t *string); + +static isc_result_t +generic_totext_ds(ARGS_TOTEXT); + +static isc_result_t +generic_tostruct_ds(ARGS_TOSTRUCT); + +static isc_result_t +generic_fromtext_ds(ARGS_FROMTEXT); + +static isc_result_t +generic_fromwire_ds(ARGS_FROMWIRE); + +static isc_result_t +generic_fromstruct_ds(ARGS_FROMSTRUCT); + +static isc_result_t +generic_fromtext_tlsa(ARGS_FROMTEXT); + +static isc_result_t +generic_totext_tlsa(ARGS_TOTEXT); + +static isc_result_t +generic_fromwire_tlsa(ARGS_FROMWIRE); + +static isc_result_t +generic_fromstruct_tlsa(ARGS_FROMSTRUCT); + +static isc_result_t +generic_tostruct_tlsa(ARGS_TOSTRUCT); + +static void +generic_freestruct_tlsa(ARGS_FREESTRUCT); + /*% INT16 Size */ #define NS_INT16SZ 2 /*% IPv6 Address Size */ @@ -339,6 +417,160 @@ mem_maybedup(isc_mem_t *mctx, void *source, size_t length) { return (copy); } +static inline isc_result_t +typemap_fromtext(isc_lex_t *lexer, isc_buffer_t *target, + isc_boolean_t allow_empty) +{ + isc_token_t token; + unsigned char bm[8*1024]; /* 64k bits */ + dns_rdatatype_t covered, max_used; + int octet; + unsigned int max_octet, newend, end; + int window; + isc_boolean_t first = ISC_TRUE; + + max_used = 0; + bm[0] = 0; + end = 0; + + do { + RETERR(isc_lex_getmastertoken(lexer, &token, + isc_tokentype_string, ISC_TRUE)); + if (token.type != isc_tokentype_string) + break; + RETTOK(dns_rdatatype_fromtext(&covered, + &token.value.as_textregion)); + if (covered > max_used) { + newend = covered / 8; + if (newend > end) { + memset(&bm[end + 1], 0, newend - end); + end = newend; + } + max_used = covered; + } + bm[covered/8] |= (0x80>>(covered%8)); + first = ISC_FALSE; + } while (1); + isc_lex_ungettoken(lexer, &token); + if (!allow_empty && first) + return (DNS_R_FORMERR); + + for (window = 0; window < 256 ; window++) { + if (max_used < window * 256) + break; + + max_octet = max_used - (window * 256); + if (max_octet >= 256) + max_octet = 31; + else + max_octet /= 8; + + /* + * Find if we have a type in this window. + */ + for (octet = max_octet; octet >= 0; octet--) { + if (bm[window * 32 + octet] != 0) + break; + } + if (octet < 0) + continue; + RETERR(uint8_tobuffer(window, target)); + RETERR(uint8_tobuffer(octet + 1, target)); + RETERR(mem_tobuffer(target, &bm[window * 32], octet + 1)); + } + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +typemap_totext(isc_region_t *sr, dns_rdata_textctx_t *tctx, + isc_buffer_t *target) +{ + unsigned int i, j, k; + unsigned int window, len; + isc_boolean_t first = ISC_FALSE; + + for (i = 0; i < sr->length; i += len) { + if (tctx != NULL && + (tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) { + RETERR(str_totext(tctx->linebreak, target)); + first = ISC_TRUE; + } + INSIST(i + 2 <= sr->length); + window = sr->base[i]; + len = sr->base[i + 1]; + INSIST(len > 0 && len <= 32); + i += 2; + INSIST(i + len <= sr->length); + for (j = 0; j < len; j++) { + dns_rdatatype_t t; + if (sr->base[i + j] == 0) + continue; + for (k = 0; k < 8; k++) { + if ((sr->base[i + j] & (0x80 >> k)) == 0) + continue; + t = window * 256 + j * 8 + k; + if (!first) + RETERR(str_totext(" ", target)); + first = ISC_FALSE; + if (dns_rdatatype_isknown(t)) { + RETERR(dns_rdatatype_totext(t, target)); + } else { + char buf[sizeof("TYPE65535")]; + sprintf(buf, "TYPE%u", t); + RETERR(str_totext(buf, target)); + } + } + } + } + return (ISC_R_SUCCESS); +} + +static isc_result_t +typemap_test(isc_region_t *sr, isc_boolean_t allow_empty) { + unsigned int window, lastwindow = 0; + unsigned int len; + isc_boolean_t first = ISC_TRUE; + unsigned int i; + + for (i = 0; i < sr->length; i += len) { + /* + * Check for overflow. + */ + if (i + 2 > sr->length) + RETERR(DNS_R_FORMERR); + window = sr->base[i]; + len = sr->base[i + 1]; + i += 2; + /* + * Check that bitmap windows are in the correct order. + */ + if (!first && window <= lastwindow) + RETERR(DNS_R_FORMERR); + /* + * Check for legal lengths. + */ + if (len < 1 || len > 32) + RETERR(DNS_R_FORMERR); + /* + * Check for overflow. + */ + if (i + len > sr->length) + RETERR(DNS_R_FORMERR); + /* + * The last octet of the bitmap must be non zero. + */ + if (sr->base[i + len - 1] == 0) + RETERR(DNS_R_FORMERR); + lastwindow = window; + first = ISC_FALSE; + } + if (i != sr->length) + return (DNS_R_EXTRADATA); + if (!allow_empty && first) + RETERR(DNS_R_FORMERR); + return (ISC_R_SUCCESS); +} + static const char hexdigits[] = "0123456789abcdef"; static const char decdigits[] = "0123456789"; @@ -1591,6 +1823,9 @@ static isc_result_t mem_tobuffer(isc_buffer_t *target, void *base, unsigned int length) { isc_region_t tr; + if (length == 0U) + return (ISC_R_SUCCESS); + isc_buffer_availableregion(target, &tr); if (length > tr.length) return (ISC_R_NOSPACE); diff --git a/contrib/bind9/lib/dns/rdata/any_255/tsig_250.c b/contrib/bind9/lib/dns/rdata/any_255/tsig_250.c index 65ceb8415..abdf3203e 100644 --- a/contrib/bind9/lib/dns/rdata/any_255/tsig_250.c +++ b/contrib/bind9/lib/dns/rdata/any_255/tsig_250.c @@ -49,7 +49,8 @@ fromtext_any_tsig(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); /* diff --git a/contrib/bind9/lib/dns/rdata/ch_3/a_1.c b/contrib/bind9/lib/dns/rdata/ch_3/a_1.c index 34a059b34..5250bd5a9 100644 --- a/contrib/bind9/lib/dns/rdata/ch_3/a_1.c +++ b/contrib/bind9/lib/dns/rdata/ch_3/a_1.c @@ -44,7 +44,8 @@ fromtext_ch_a(ARGS_FROMTEXT) { /* get domain name */ dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); if ((options & DNS_RDATA_CHECKNAMES) != 0 && (options & DNS_RDATA_CHECKREVERSE) != 0) { diff --git a/contrib/bind9/lib/dns/rdata/generic/afsdb_18.c b/contrib/bind9/lib/dns/rdata/generic/afsdb_18.c index 75f644f2c..88564a150 100644 --- a/contrib/bind9/lib/dns/rdata/generic/afsdb_18.c +++ b/contrib/bind9/lib/dns/rdata/generic/afsdb_18.c @@ -55,7 +55,8 @@ fromtext_afsdb(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); ok = ISC_TRUE; if ((options & DNS_RDATA_CHECKNAMES) != 0) diff --git a/contrib/bind9/lib/dns/rdata/generic/avc_258.c b/contrib/bind9/lib/dns/rdata/generic/avc_258.c new file mode 100644 index 000000000..e74903f48 --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/avc_258.c @@ -0,0 +1,168 @@ +/* + * Copyright (C) 2016 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef RDATA_GENERIC_AVC_258_C +#define RDATA_GENERIC_AVC_258_C + +#define RRTYPE_AVC_ATTRIBUTES (0) + +static inline isc_result_t +fromtext_avc(ARGS_FROMTEXT) { + + REQUIRE(type == dns_rdatatype_avc); + + UNUSED(type); + UNUSED(rdclass); + UNUSED(origin); + UNUSED(options); + UNUSED(callbacks); + + return (generic_fromtext_txt(rdclass, type, lexer, origin, options, + target, callbacks)); +} + +static inline isc_result_t +totext_avc(ARGS_TOTEXT) { + + UNUSED(tctx); + + REQUIRE(rdata->type == dns_rdatatype_avc); + + return (generic_totext_txt(rdata, tctx, target)); +} + +static inline isc_result_t +fromwire_avc(ARGS_FROMWIRE) { + + REQUIRE(type == dns_rdatatype_avc); + + UNUSED(type); + UNUSED(dctx); + UNUSED(rdclass); + UNUSED(options); + + return (generic_fromwire_txt(rdclass, type, source, dctx, options, + target)); +} + +static inline isc_result_t +towire_avc(ARGS_TOWIRE) { + + REQUIRE(rdata->type == dns_rdatatype_avc); + + UNUSED(cctx); + + return (mem_tobuffer(target, rdata->data, rdata->length)); +} + +static inline int +compare_avc(ARGS_COMPARE) { + isc_region_t r1; + isc_region_t r2; + + REQUIRE(rdata1->type == rdata2->type); + REQUIRE(rdata1->rdclass == rdata2->rdclass); + REQUIRE(rdata1->type == dns_rdatatype_avc); + + dns_rdata_toregion(rdata1, &r1); + dns_rdata_toregion(rdata2, &r2); + return (isc_region_compare(&r1, &r2)); +} + +static inline isc_result_t +fromstruct_avc(ARGS_FROMSTRUCT) { + + REQUIRE(type == dns_rdatatype_avc); + + return (generic_fromstruct_txt(rdclass, type, source, target)); +} + +static inline isc_result_t +tostruct_avc(ARGS_TOSTRUCT) { + dns_rdata_avc_t *avc = target; + + REQUIRE(rdata->type == dns_rdatatype_avc); + REQUIRE(target != NULL); + + avc->common.rdclass = rdata->rdclass; + avc->common.rdtype = rdata->type; + ISC_LINK_INIT(&avc->common, link); + + return (generic_tostruct_txt(rdata, target, mctx)); +} + +static inline void +freestruct_avc(ARGS_FREESTRUCT) { + dns_rdata_avc_t *txt = source; + + REQUIRE(source != NULL); + REQUIRE(txt->common.rdtype == dns_rdatatype_avc); + + generic_freestruct_txt(source); +} + +static inline isc_result_t +additionaldata_avc(ARGS_ADDLDATA) { + REQUIRE(rdata->type == dns_rdatatype_avc); + + UNUSED(rdata); + UNUSED(add); + UNUSED(arg); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +digest_avc(ARGS_DIGEST) { + isc_region_t r; + + REQUIRE(rdata->type == dns_rdatatype_avc); + + dns_rdata_toregion(rdata, &r); + + return ((digest)(arg, &r)); +} + +static inline isc_boolean_t +checkowner_avc(ARGS_CHECKOWNER) { + + REQUIRE(type == dns_rdatatype_avc); + + UNUSED(name); + UNUSED(type); + UNUSED(rdclass); + UNUSED(wildcard); + + return (ISC_TRUE); +} + +static inline isc_boolean_t +checknames_avc(ARGS_CHECKNAMES) { + + REQUIRE(rdata->type == dns_rdatatype_avc); + + UNUSED(rdata); + UNUSED(owner); + UNUSED(bad); + + return (ISC_TRUE); +} + +static inline int +casecompare_avc(ARGS_COMPARE) { + return (compare_avc(rdata1, rdata2)); +} +#endif /* RDATA_GENERIC_AVC_258_C */ diff --git a/contrib/bind9/lib/dns/rdata/generic/avc_258.h b/contrib/bind9/lib/dns/rdata/generic/avc_258.h new file mode 100644 index 000000000..d32282e3d --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/avc_258.h @@ -0,0 +1,35 @@ +/* + * Copyright (C) 2016 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_AVC_258_H +#define GENERIC_AVC_258_H 1 + +typedef dns_rdata_txt_string_t dns_rdata_avc_string_t; + +typedef struct dns_rdata_avc { + dns_rdatacommon_t common; + isc_mem_t *mctx; + unsigned char *data; + isc_uint16_t length; + /* private */ + isc_uint16_t offset; +} dns_rdata_avc_t; + +/* + * ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS are already done + * via rdatastructpre.h and rdatastructsuf.h. + */ +#endif /* GENERIC_AVC_258_H */ diff --git a/contrib/bind9/lib/dns/rdata/generic/caa_257.c b/contrib/bind9/lib/dns/rdata/generic/caa_257.c index 648f4afdc..1a681652a 100644 --- a/contrib/bind9/lib/dns/rdata/generic/caa_257.c +++ b/contrib/bind9/lib/dns/rdata/generic/caa_257.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2014, 2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2014-2016 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -58,7 +58,7 @@ fromtext_caa(ARGS_FROMTEXT) { ISC_FALSE)); if (token.value.as_ulong > 255U) RETTOK(ISC_R_RANGE); - flags = token.value.as_ulong; + flags = (isc_uint8_t)(token.value.as_ulong & 255U); RETERR(uint8_tobuffer(flags, target)); /* diff --git a/contrib/bind9/lib/dns/rdata/generic/cdnskey_60.c b/contrib/bind9/lib/dns/rdata/generic/cdnskey_60.c index 945b3644c..15f93fd4e 100644 --- a/contrib/bind9/lib/dns/rdata/generic/cdnskey_60.c +++ b/contrib/bind9/lib/dns/rdata/generic/cdnskey_60.c @@ -31,180 +31,29 @@ static inline isc_result_t fromtext_cdnskey(ARGS_FROMTEXT) { - isc_result_t result; - isc_token_t token; - dns_secalg_t alg; - dns_secproto_t proto; - dns_keyflags_t flags; REQUIRE(type == dns_rdatatype_cdnskey); - UNUSED(type); - UNUSED(rdclass); - UNUSED(origin); - UNUSED(options); - UNUSED(callbacks); - - /* flags */ - RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, - ISC_FALSE)); - RETTOK(dns_keyflags_fromtext(&flags, &token.value.as_textregion)); - RETERR(uint16_tobuffer(flags, target)); - - /* protocol */ - RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, - ISC_FALSE)); - RETTOK(dns_secproto_fromtext(&proto, &token.value.as_textregion)); - RETERR(mem_tobuffer(target, &proto, 1)); - - /* algorithm */ - RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, - ISC_FALSE)); - RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion)); - RETERR(mem_tobuffer(target, &alg, 1)); - - /* No Key? */ - if ((flags & 0xc000) == 0xc000) - return (ISC_R_SUCCESS); - - result = isc_base64_tobuffer(lexer, target, -1); - if (result != ISC_R_SUCCESS) - return (result); - - /* Ensure there's at least enough data to compute a key ID for MD5 */ - if (alg == DST_ALG_RSAMD5 && isc_buffer_usedlength(target) < 7) - return (ISC_R_UNEXPECTEDEND); - - return (ISC_R_SUCCESS); + return (generic_fromtext_key(rdclass, type, lexer, origin, + options, target, callbacks)); } static inline isc_result_t totext_cdnskey(ARGS_TOTEXT) { - isc_region_t sr; - char buf[sizeof("64000")]; - unsigned int flags; - unsigned char algorithm; - char algbuf[DNS_NAME_FORMATSIZE]; - const char *keyinfo; + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_cdnskey); - REQUIRE(rdata->length != 0); - - dns_rdata_toregion(rdata, &sr); - /* flags */ - flags = uint16_fromregion(&sr); - isc_region_consume(&sr, 2); - sprintf(buf, "%u", flags); - RETERR(str_totext(buf, target)); - RETERR(str_totext(" ", target)); - if ((flags & DNS_KEYFLAG_KSK) != 0) { - if (flags & DNS_KEYFLAG_REVOKE) - keyinfo = "revoked KSK"; - else - keyinfo = "KSK"; - } else - keyinfo = "ZSK"; - - /* protocol */ - sprintf(buf, "%u", sr.base[0]); - isc_region_consume(&sr, 1); - RETERR(str_totext(buf, target)); - RETERR(str_totext(" ", target)); - - /* algorithm */ - algorithm = sr.base[0]; - sprintf(buf, "%u", algorithm); - isc_region_consume(&sr, 1); - RETERR(str_totext(buf, target)); - - /* No Key? */ - if ((flags & 0xc000) == 0xc000) - return (ISC_R_SUCCESS); - - if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0 && - algorithm == DNS_KEYALG_PRIVATEDNS) { - dns_name_t name; - dns_name_init(&name, NULL); - dns_name_fromregion(&name, &sr); - dns_name_format(&name, algbuf, sizeof(algbuf)); - } else { - dns_secalg_format((dns_secalg_t) algorithm, algbuf, - sizeof(algbuf)); - } - - /* key */ - if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) - RETERR(str_totext(" (", target)); - RETERR(str_totext(tctx->linebreak, target)); - if (tctx->width == 0) /* No splitting */ - RETERR(isc_base64_totext(&sr, 0, "", target)); - else - RETERR(isc_base64_totext(&sr, tctx->width - 2, - tctx->linebreak, target)); - - if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) - RETERR(str_totext(tctx->linebreak, target)); - else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) - RETERR(str_totext(" ", target)); - - if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) - RETERR(str_totext(")", target)); - - if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) { - isc_region_t tmpr; - - RETERR(str_totext(" ; ", target)); - RETERR(str_totext(keyinfo, target)); - RETERR(str_totext("; alg = ", target)); - RETERR(str_totext(algbuf, target)); - RETERR(str_totext("; key id = ", target)); - dns_rdata_toregion(rdata, &tmpr); - sprintf(buf, "%u", dst_region_computeid(&tmpr, algorithm)); - RETERR(str_totext(buf, target)); - } - return (ISC_R_SUCCESS); + return (generic_totext_key(rdata, tctx, target)); } static inline isc_result_t fromwire_cdnskey(ARGS_FROMWIRE) { - unsigned char algorithm; - isc_region_t sr; REQUIRE(type == dns_rdatatype_cdnskey); - UNUSED(type); - UNUSED(rdclass); - UNUSED(dctx); - UNUSED(options); - - isc_buffer_activeregion(source, &sr); - if (sr.length < 4) - return (ISC_R_UNEXPECTEDEND); - - algorithm = sr.base[3]; - RETERR(mem_tobuffer(target, sr.base, 4)); - isc_region_consume(&sr, 4); - isc_buffer_forward(source, 4); - - if (algorithm == DNS_KEYALG_PRIVATEDNS) { - dns_name_t name; - dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE); - dns_name_init(&name, NULL); - RETERR(dns_name_fromwire(&name, source, dctx, options, target)); - } - - /* - * RSAMD5 computes key ID differently from other - * algorithms: we need to ensure there's enough data - * present for the computation - */ - if (algorithm == DST_ALG_RSAMD5 && sr.length < 3) - return (ISC_R_UNEXPECTEDEND); - - isc_buffer_activeregion(source, &sr); - isc_buffer_forward(source, sr.length); - return (mem_tobuffer(target, sr.base, sr.length)); + return (generic_fromwire_key(rdclass, type, source, dctx, + options, target)); } static inline isc_result_t @@ -225,6 +74,8 @@ compare_cdnskey(ARGS_COMPARE) { isc_region_t r1; isc_region_t r2; + REQUIRE(rdata1 != NULL); + REQUIRE(rdata2 != NULL); REQUIRE(rdata1->type == rdata2->type); REQUIRE(rdata1->rdclass == rdata2->rdclass); REQUIRE(rdata1->type == dns_rdatatype_cdnskey); @@ -238,85 +89,35 @@ compare_cdnskey(ARGS_COMPARE) { static inline isc_result_t fromstruct_cdnskey(ARGS_FROMSTRUCT) { - dns_rdata_cdnskey_t *dnskey = source; REQUIRE(type == dns_rdatatype_cdnskey); - REQUIRE(source != NULL); - REQUIRE(dnskey->common.rdtype == type); - REQUIRE(dnskey->common.rdclass == rdclass); - - UNUSED(type); - UNUSED(rdclass); - - /* Flags */ - RETERR(uint16_tobuffer(dnskey->flags, target)); - /* Protocol */ - RETERR(uint8_tobuffer(dnskey->protocol, target)); - - /* Algorithm */ - RETERR(uint8_tobuffer(dnskey->algorithm, target)); - - /* Data */ - return (mem_tobuffer(target, dnskey->data, dnskey->datalen)); + return (generic_fromstruct_key(rdclass, type, source, target)); } static inline isc_result_t tostruct_cdnskey(ARGS_TOSTRUCT) { dns_rdata_cdnskey_t *dnskey = target; - isc_region_t sr; + REQUIRE(dnskey != NULL); + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_cdnskey); - REQUIRE(target != NULL); - REQUIRE(rdata->length != 0); dnskey->common.rdclass = rdata->rdclass; dnskey->common.rdtype = rdata->type; ISC_LINK_INIT(&dnskey->common, link); - dns_rdata_toregion(rdata, &sr); - - /* Flags */ - if (sr.length < 2) - return (ISC_R_UNEXPECTEDEND); - dnskey->flags = uint16_fromregion(&sr); - isc_region_consume(&sr, 2); - - /* Protocol */ - if (sr.length < 1) - return (ISC_R_UNEXPECTEDEND); - dnskey->protocol = uint8_fromregion(&sr); - isc_region_consume(&sr, 1); - - /* Algorithm */ - if (sr.length < 1) - return (ISC_R_UNEXPECTEDEND); - dnskey->algorithm = uint8_fromregion(&sr); - isc_region_consume(&sr, 1); - - /* Data */ - dnskey->datalen = sr.length; - dnskey->data = mem_maybedup(mctx, sr.base, dnskey->datalen); - if (dnskey->data == NULL) - return (ISC_R_NOMEMORY); - - dnskey->mctx = mctx; - return (ISC_R_SUCCESS); + return (generic_tostruct_key(rdata, target, mctx)); } static inline void freestruct_cdnskey(ARGS_FREESTRUCT) { dns_rdata_cdnskey_t *dnskey = (dns_rdata_cdnskey_t *) source; - REQUIRE(source != NULL); + REQUIRE(dnskey != NULL); REQUIRE(dnskey->common.rdtype == dns_rdatatype_cdnskey); - if (dnskey->mctx == NULL) - return; - - if (dnskey->data != NULL) - isc_mem_free(dnskey->mctx, dnskey->data); - dnskey->mctx = NULL; + generic_freestruct_key(source); } static inline isc_result_t @@ -334,6 +135,7 @@ static inline isc_result_t digest_cdnskey(ARGS_DIGEST) { isc_region_t r; + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_cdnskey); dns_rdata_toregion(rdata, &r); @@ -357,6 +159,7 @@ checkowner_cdnskey(ARGS_CHECKOWNER) { static inline isc_boolean_t checknames_cdnskey(ARGS_CHECKNAMES) { + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_cdnskey); UNUSED(rdata); diff --git a/contrib/bind9/lib/dns/rdata/generic/cdnskey_60.h b/contrib/bind9/lib/dns/rdata/generic/cdnskey_60.h index d284177c1..c52035eac 100644 --- a/contrib/bind9/lib/dns/rdata/generic/cdnskey_60.h +++ b/contrib/bind9/lib/dns/rdata/generic/cdnskey_60.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2014, 2015 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -18,15 +18,6 @@ #define GENERIC_CDNSKEY_60_H 1 /* CDNSKEY records have the same RDATA fields as DNSKEY records. */ -typedef struct dns_rdata_cdnskey { - dns_rdatacommon_t common; - isc_mem_t * mctx; - isc_uint16_t flags; - isc_uint8_t protocol; - isc_uint8_t algorithm; - isc_uint16_t datalen; - unsigned char * data; -} dns_rdata_cdnskey_t; - +typedef struct dns_rdata_key dns_rdata_cdnskey_t; #endif /* GENERIC_CDNSKEY_60_H */ diff --git a/contrib/bind9/lib/dns/rdata/generic/cds_59.c b/contrib/bind9/lib/dns/rdata/generic/cds_59.c index b58d5f799..966ba0a3f 100644 --- a/contrib/bind9/lib/dns/rdata/generic/cds_59.c +++ b/contrib/bind9/lib/dns/rdata/generic/cds_59.c @@ -30,164 +30,28 @@ static inline isc_result_t fromtext_cds(ARGS_FROMTEXT) { - isc_token_t token; - unsigned char c; - int length; REQUIRE(type == dns_rdatatype_cds); - UNUSED(type); - UNUSED(rdclass); - UNUSED(origin); - UNUSED(options); - UNUSED(callbacks); - - /* - * Key tag. - */ - RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, - ISC_FALSE)); - if (token.value.as_ulong > 0xffffU) - RETTOK(ISC_R_RANGE); - RETERR(uint16_tobuffer(token.value.as_ulong, target)); - - /* - * Algorithm. - */ - RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, - ISC_FALSE)); - RETTOK(dns_secalg_fromtext(&c, &token.value.as_textregion)); - RETERR(mem_tobuffer(target, &c, 1)); - - /* - * Digest type. - */ - RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, - ISC_FALSE)); - if (token.value.as_ulong > 0xffU) - RETTOK(ISC_R_RANGE); - RETERR(uint8_tobuffer(token.value.as_ulong, target)); - c = (unsigned char) token.value.as_ulong; - - /* - * Digest. - */ - switch (c) { - case DNS_DSDIGEST_SHA1: - length = ISC_SHA1_DIGESTLENGTH; - break; - case DNS_DSDIGEST_SHA256: - length = ISC_SHA256_DIGESTLENGTH; - break; - case DNS_DSDIGEST_GOST: - length = ISC_GOST_DIGESTLENGTH; - break; - case DNS_DSDIGEST_SHA384: - length = ISC_SHA384_DIGESTLENGTH; - break; - default: - length = -1; - break; - } - return (isc_hex_tobuffer(lexer, target, length)); + return (generic_fromtext_ds(rdclass, type, lexer, origin, options, + target, callbacks)); } static inline isc_result_t totext_cds(ARGS_TOTEXT) { - isc_region_t sr; - char buf[sizeof("64000 ")]; - unsigned int n; REQUIRE(rdata->type == dns_rdatatype_cds); - REQUIRE(rdata->length != 0); - UNUSED(tctx); - - dns_rdata_toregion(rdata, &sr); - - /* - * Key tag. - */ - n = uint16_fromregion(&sr); - isc_region_consume(&sr, 2); - sprintf(buf, "%u ", n); - RETERR(str_totext(buf, target)); - - /* - * Algorithm. - */ - n = uint8_fromregion(&sr); - isc_region_consume(&sr, 1); - sprintf(buf, "%u ", n); - RETERR(str_totext(buf, target)); - - /* - * Digest type. - */ - n = uint8_fromregion(&sr); - isc_region_consume(&sr, 1); - sprintf(buf, "%u", n); - RETERR(str_totext(buf, target)); - - /* - * Digest. - */ - if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) - RETERR(str_totext(" (", target)); - RETERR(str_totext(tctx->linebreak, target)); - if (tctx->width == 0) /* No splitting */ - RETERR(isc_hex_totext(&sr, 0, "", target)); - else - RETERR(isc_hex_totext(&sr, tctx->width - 2, - tctx->linebreak, target)); - if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) - RETERR(str_totext(" )", target)); - return (ISC_R_SUCCESS); + return (generic_totext_ds(rdata, tctx, target)); } static inline isc_result_t fromwire_cds(ARGS_FROMWIRE) { - isc_region_t sr; REQUIRE(type == dns_rdatatype_cds); - UNUSED(type); - UNUSED(rdclass); - UNUSED(dctx); - UNUSED(options); - - isc_buffer_activeregion(source, &sr); - - /* - * Check digest lengths if we know them. - */ - if (sr.length < 4 || - (sr.base[3] == DNS_DSDIGEST_SHA1 && - sr.length < 4 + ISC_SHA1_DIGESTLENGTH) || - (sr.base[3] == DNS_DSDIGEST_SHA256 && - sr.length < 4 + ISC_SHA256_DIGESTLENGTH) || - (sr.base[3] == DNS_DSDIGEST_GOST && - sr.length < 4 + ISC_GOST_DIGESTLENGTH) || - (sr.base[3] == DNS_DSDIGEST_SHA384 && - sr.length < 4 + ISC_SHA384_DIGESTLENGTH)) - return (ISC_R_UNEXPECTEDEND); - - /* - * Only copy digest lengths if we know them. - * If there is extra data dns_rdata_fromwire() will - * detect that. - */ - if (sr.base[3] == DNS_DSDIGEST_SHA1) - sr.length = 4 + ISC_SHA1_DIGESTLENGTH; - else if (sr.base[3] == DNS_DSDIGEST_SHA256) - sr.length = 4 + ISC_SHA256_DIGESTLENGTH; - else if (sr.base[3] == DNS_DSDIGEST_GOST) - sr.length = 4 + ISC_GOST_DIGESTLENGTH; - else if (sr.base[3] == DNS_DSDIGEST_SHA384) - sr.length = 4 + ISC_SHA384_DIGESTLENGTH; - - isc_buffer_forward(source, sr.length); - return (mem_tobuffer(target, sr.base, sr.length)); + return (generic_fromwire_ds(rdclass, type, source, dctx, options, + target)); } static inline isc_result_t @@ -221,66 +85,28 @@ compare_cds(ARGS_COMPARE) { static inline isc_result_t fromstruct_cds(ARGS_FROMSTRUCT) { - dns_rdata_cds_t *ds = source; REQUIRE(type == dns_rdatatype_cds); - REQUIRE(source != NULL); - REQUIRE(ds->common.rdtype == type); - REQUIRE(ds->common.rdclass == rdclass); - switch (ds->digest_type) { - case DNS_DSDIGEST_SHA1: - REQUIRE(ds->length == ISC_SHA1_DIGESTLENGTH); - break; - case DNS_DSDIGEST_SHA256: - REQUIRE(ds->length == ISC_SHA256_DIGESTLENGTH); - break; - case DNS_DSDIGEST_GOST: - REQUIRE(ds->length == ISC_GOST_DIGESTLENGTH); - break; - case DNS_DSDIGEST_SHA384: - REQUIRE(ds->length == ISC_SHA384_DIGESTLENGTH); - break; - } - - UNUSED(type); - UNUSED(rdclass); - - RETERR(uint16_tobuffer(ds->key_tag, target)); - RETERR(uint8_tobuffer(ds->algorithm, target)); - RETERR(uint8_tobuffer(ds->digest_type, target)); - return (mem_tobuffer(target, ds->digest, ds->length)); + return (generic_fromstruct_ds(rdclass, type, source, target)); } static inline isc_result_t tostruct_cds(ARGS_TOSTRUCT) { - dns_rdata_cds_t *ds = target; - isc_region_t region; + dns_rdata_cds_t *cds = target; REQUIRE(rdata->type == dns_rdatatype_cds); REQUIRE(target != NULL); REQUIRE(rdata->length != 0); - ds->common.rdclass = rdata->rdclass; - ds->common.rdtype = rdata->type; - ISC_LINK_INIT(&ds->common, link); - - dns_rdata_toregion(rdata, ®ion); - - ds->key_tag = uint16_fromregion(®ion); - isc_region_consume(®ion, 2); - ds->algorithm = uint8_fromregion(®ion); - isc_region_consume(®ion, 1); - ds->digest_type = uint8_fromregion(®ion); - isc_region_consume(®ion, 1); - ds->length = region.length; - - ds->digest = mem_maybedup(mctx, region.base, region.length); - if (ds->digest == NULL) - return (ISC_R_NOMEMORY); + /* + * Checked by generic_tostruct_ds(). + */ + cds->common.rdclass = rdata->rdclass; + cds->common.rdtype = rdata->type; + ISC_LINK_INIT(&cds->common, link); - ds->mctx = mctx; - return (ISC_R_SUCCESS); + return (generic_tostruct_ds(rdata, target, mctx)); } static inline void diff --git a/contrib/bind9/lib/dns/rdata/generic/cds_59.h b/contrib/bind9/lib/dns/rdata/generic/cds_59.h index 099cba394..c51cefbf2 100644 --- a/contrib/bind9/lib/dns/rdata/generic/cds_59.h +++ b/contrib/bind9/lib/dns/rdata/generic/cds_59.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2014, 2015 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -18,14 +18,6 @@ #define GENERIC_CDS_59_H 1 /* CDS records have the same RDATA fields as DS records. */ -typedef struct dns_rdata_cds { - dns_rdatacommon_t common; - isc_mem_t *mctx; - isc_uint16_t key_tag; - isc_uint8_t algorithm; - isc_uint8_t digest_type; - isc_uint16_t length; - unsigned char *digest; -} dns_rdata_cds_t; +typedef struct dns_rdata_ds dns_rdata_cds_t; #endif /* GENERIC_CDS_59_H */ diff --git a/contrib/bind9/lib/dns/rdata/generic/cname_5.c b/contrib/bind9/lib/dns/rdata/generic/cname_5.c index 3f8a69b28..fc7356189 100644 --- a/contrib/bind9/lib/dns/rdata/generic/cname_5.c +++ b/contrib/bind9/lib/dns/rdata/generic/cname_5.c @@ -42,7 +42,8 @@ fromtext_cname(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); return (ISC_R_SUCCESS); } diff --git a/contrib/bind9/lib/dns/rdata/generic/csync_62.c b/contrib/bind9/lib/dns/rdata/generic/csync_62.c new file mode 100644 index 000000000..cd8019593 --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/csync_62.c @@ -0,0 +1,268 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* RFC 7477 */ + +#ifndef RDATA_GENERIC_CSYNC_62_C +#define RDATA_GENERIC_CSYNC_62_C + +#define RRTYPE_CSYNC_ATTRIBUTES 0 + +static inline isc_result_t +fromtext_csync(ARGS_FROMTEXT) { + isc_token_t token; + + REQUIRE(type == dns_rdatatype_csync); + + UNUSED(type); + UNUSED(rdclass); + UNUSED(origin); + UNUSED(options); + UNUSED(callbacks); + + /* Serial. */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, + ISC_FALSE)); + RETERR(uint32_tobuffer(token.value.as_ulong, target)); + + /* Flags. */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, + ISC_FALSE)); + if (token.value.as_ulong > 0xffffU) + RETTOK(ISC_R_RANGE); + RETERR(uint16_tobuffer(token.value.as_ulong, target)); + + /* Type Map */ + return (typemap_fromtext(lexer, target, ISC_TRUE)); +} + +static inline isc_result_t +totext_csync(ARGS_TOTEXT) { + unsigned long num; + char buf[sizeof("0123456789")]; /* Also TYPE65535 */ + isc_region_t sr; + + REQUIRE(rdata->type == dns_rdatatype_csync); + REQUIRE(rdata->length >= 6); + + UNUSED(tctx); + + dns_rdata_toregion(rdata, &sr); + + num = uint32_fromregion(&sr); + isc_region_consume(&sr, 4); + sprintf(buf, "%lu", num); + RETERR(str_totext(buf, target)); + + RETERR(str_totext(" ", target)); + + num = uint16_fromregion(&sr); + isc_region_consume(&sr, 2); + sprintf(buf, "%lu", num); + RETERR(str_totext(buf, target)); + + return (typemap_totext(&sr, NULL, target)); +} + +static /* inline */ isc_result_t +fromwire_csync(ARGS_FROMWIRE) { + isc_region_t sr; + + REQUIRE(type == dns_rdatatype_csync); + + UNUSED(type); + UNUSED(rdclass); + UNUSED(options); + UNUSED(dctx); + + /* + * Serial + Flags + */ + isc_buffer_activeregion(source, &sr); + if (sr.length < 6) + return (ISC_R_UNEXPECTEDEND); + + RETERR(mem_tobuffer(target, sr.base, 6)); + isc_buffer_forward(source, 6); + isc_region_consume(&sr, 6); + + RETERR(typemap_test(&sr, ISC_TRUE)); + + RETERR(mem_tobuffer(target, sr.base, sr.length)); + isc_buffer_forward(source, sr.length); + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +towire_csync(ARGS_TOWIRE) { + + REQUIRE(rdata->type == dns_rdatatype_csync); + REQUIRE(rdata->length >= 6); + + UNUSED(cctx); + + return (mem_tobuffer(target, rdata->data, rdata->length)); +} + +static inline int +compare_csync(ARGS_COMPARE) { + isc_region_t r1; + isc_region_t r2; + + REQUIRE(rdata1->type == rdata2->type); + REQUIRE(rdata1->rdclass == rdata2->rdclass); + REQUIRE(rdata1->type == dns_rdatatype_csync); + REQUIRE(rdata1->length >= 6); + REQUIRE(rdata2->length >= 6); + + dns_rdata_toregion(rdata1, &r1); + dns_rdata_toregion(rdata2, &r2); + return (isc_region_compare(&r1, &r2)); +} + +static inline isc_result_t +fromstruct_csync(ARGS_FROMSTRUCT) { + dns_rdata_csync_t *csync = source; + isc_region_t region; + + REQUIRE(type == dns_rdatatype_csync); + REQUIRE(source != NULL); + REQUIRE(csync->common.rdtype == type); + REQUIRE(csync->common.rdclass == rdclass); + REQUIRE(csync->typebits != NULL || csync->len == 0); + + UNUSED(type); + UNUSED(rdclass); + + RETERR(uint32_tobuffer(csync->serial, target)); + RETERR(uint16_tobuffer(csync->flags, target)); + + region.base = csync->typebits; + region.length = csync->len; + RETERR(typemap_test(®ion, ISC_TRUE)); + return (mem_tobuffer(target, csync->typebits, csync->len)); +} + +static inline isc_result_t +tostruct_csync(ARGS_TOSTRUCT) { + isc_region_t region; + dns_rdata_csync_t *csync = target; + + REQUIRE(rdata->type == dns_rdatatype_csync); + REQUIRE(target != NULL); + REQUIRE(rdata->length != 0); + + csync->common.rdclass = rdata->rdclass; + csync->common.rdtype = rdata->type; + ISC_LINK_INIT(&csync->common, link); + + dns_rdata_toregion(rdata, ®ion); + + csync->serial = uint32_fromregion(®ion); + isc_region_consume(®ion, 4); + + csync->flags = uint16_fromregion(®ion); + isc_region_consume(®ion, 2); + + csync->len = region.length; + csync->typebits = mem_maybedup(mctx, region.base, region.length); + if (csync->typebits == NULL) + goto cleanup; + + csync->mctx = mctx; + return (ISC_R_SUCCESS); + + cleanup: + return (ISC_R_NOMEMORY); +} + +static inline void +freestruct_csync(ARGS_FREESTRUCT) { + dns_rdata_csync_t *csync = source; + + REQUIRE(source != NULL); + REQUIRE(csync->common.rdtype == dns_rdatatype_csync); + + if (csync->mctx == NULL) + return; + + if (csync->typebits != NULL) + isc_mem_free(csync->mctx, csync->typebits); + csync->mctx = NULL; +} + +static inline isc_result_t +additionaldata_csync(ARGS_ADDLDATA) { + REQUIRE(rdata->type == dns_rdatatype_csync); + + UNUSED(rdata); + UNUSED(add); + UNUSED(arg); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +digest_csync(ARGS_DIGEST) { + isc_region_t r; + + REQUIRE(rdata->type == dns_rdatatype_csync); + + dns_rdata_toregion(rdata, &r); + return ((digest)(arg, &r)); +} + +static inline isc_boolean_t +checkowner_csync(ARGS_CHECKOWNER) { + + REQUIRE(type == dns_rdatatype_csync); + + UNUSED(name); + UNUSED(type); + UNUSED(rdclass); + UNUSED(wildcard); + + return (ISC_TRUE); +} + +static inline isc_boolean_t +checknames_csync(ARGS_CHECKNAMES) { + + REQUIRE(rdata->type == dns_rdatatype_csync); + + UNUSED(rdata); + UNUSED(owner); + UNUSED(bad); + + return (ISC_TRUE); +} + +static inline int +casecompare_csync(ARGS_COMPARE) { + isc_region_t region1; + isc_region_t region2; + + REQUIRE(rdata1->type == rdata2->type); + REQUIRE(rdata1->rdclass == rdata2->rdclass); + REQUIRE(rdata1->type == dns_rdatatype_csync); + REQUIRE(rdata1->length >= 6); + REQUIRE(rdata2->length >= 6); + + dns_rdata_toregion(rdata1, ®ion1); + dns_rdata_toregion(rdata2, ®ion2); + return (isc_region_compare(®ion1, ®ion2)); +} +#endif /* RDATA_GENERIC_CSYNC_62_C */ diff --git a/contrib/bind9/lib/dns/rdata/generic/csync_62.h b/contrib/bind9/lib/dns/rdata/generic/csync_62.h new file mode 100644 index 000000000..1e4d3de42 --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/csync_62.h @@ -0,0 +1,33 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_CSYNC_62_H +#define GENERIC_CSYNC_62_H 1 + +/*! + * \brief Per RFC 7477 + */ + +typedef struct dns_rdata_csync { + dns_rdatacommon_t common; + isc_mem_t *mctx; + isc_uint32_t serial; + isc_uint16_t flags; + unsigned char *typebits; + isc_uint16_t len; +} dns_rdata_csync_t; + +#endif /* GENERIC_CSYNC_62_H */ diff --git a/contrib/bind9/lib/dns/rdata/generic/dlv_32769.c b/contrib/bind9/lib/dns/rdata/generic/dlv_32769.c index 3ff575766..263f3f568 100644 --- a/contrib/bind9/lib/dns/rdata/generic/dlv_32769.c +++ b/contrib/bind9/lib/dns/rdata/generic/dlv_32769.c @@ -31,165 +31,28 @@ static inline isc_result_t fromtext_dlv(ARGS_FROMTEXT) { - isc_token_t token; - unsigned char c; - int length; REQUIRE(type == dns_rdatatype_dlv); - UNUSED(type); - UNUSED(rdclass); - UNUSED(origin); - UNUSED(options); - UNUSED(callbacks); - - /* - * Key tag. - */ - RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, - ISC_FALSE)); - if (token.value.as_ulong > 0xffffU) - RETTOK(ISC_R_RANGE); - RETERR(uint16_tobuffer(token.value.as_ulong, target)); - - /* - * Algorithm. - */ - RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, - ISC_FALSE)); - if (token.value.as_ulong > 0xffU) - RETTOK(ISC_R_RANGE); - RETERR(uint8_tobuffer(token.value.as_ulong, target)); - - /* - * Digest type. - */ - RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, - ISC_FALSE)); - if (token.value.as_ulong > 0xffU) - RETTOK(ISC_R_RANGE); - RETERR(uint8_tobuffer(token.value.as_ulong, target)); - c = (unsigned char) token.value.as_ulong; - - /* - * Digest. - */ - switch (c) { - case DNS_DSDIGEST_SHA1: - length = ISC_SHA1_DIGESTLENGTH; - break; - case DNS_DSDIGEST_SHA256: - length = ISC_SHA256_DIGESTLENGTH; - break; - case DNS_DSDIGEST_GOST: - length = ISC_GOST_DIGESTLENGTH; - break; - case DNS_DSDIGEST_SHA384: - length = ISC_SHA384_DIGESTLENGTH; - break; - default: - length = -1; - break; - } - return (isc_hex_tobuffer(lexer, target, length)); + return (generic_fromtext_ds(rdclass, type, lexer, origin, options, + target, callbacks)); } static inline isc_result_t totext_dlv(ARGS_TOTEXT) { - isc_region_t sr; - char buf[sizeof("64000 ")]; - unsigned int n; REQUIRE(rdata->type == dns_rdatatype_dlv); - REQUIRE(rdata->length != 0); - - UNUSED(tctx); - dns_rdata_toregion(rdata, &sr); - - /* - * Key tag. - */ - n = uint16_fromregion(&sr); - isc_region_consume(&sr, 2); - sprintf(buf, "%u ", n); - RETERR(str_totext(buf, target)); - - /* - * Algorithm. - */ - n = uint8_fromregion(&sr); - isc_region_consume(&sr, 1); - sprintf(buf, "%u ", n); - RETERR(str_totext(buf, target)); - - /* - * Digest type. - */ - n = uint8_fromregion(&sr); - isc_region_consume(&sr, 1); - sprintf(buf, "%u", n); - RETERR(str_totext(buf, target)); - - /* - * Digest. - */ - if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) - RETERR(str_totext(" (", target)); - RETERR(str_totext(tctx->linebreak, target)); - if (tctx->width == 0) /* No splitting */ - RETERR(isc_hex_totext(&sr, 0, "", target)); - else - RETERR(isc_hex_totext(&sr, tctx->width - 2, - tctx->linebreak, target)); - if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) - RETERR(str_totext(" )", target)); - return (ISC_R_SUCCESS); + return (generic_totext_ds(rdata, tctx, target)); } static inline isc_result_t fromwire_dlv(ARGS_FROMWIRE) { - isc_region_t sr; REQUIRE(type == dns_rdatatype_dlv); - UNUSED(type); - UNUSED(rdclass); - UNUSED(dctx); - UNUSED(options); - - isc_buffer_activeregion(source, &sr); - - /* - * Check digest lengths if we know them. - */ - if (sr.length < 4 || - (sr.base[3] == DNS_DSDIGEST_SHA1 && - sr.length < 4 + ISC_SHA1_DIGESTLENGTH) || - (sr.base[3] == DNS_DSDIGEST_SHA256 && - sr.length < 4 + ISC_SHA256_DIGESTLENGTH) || - (sr.base[3] == DNS_DSDIGEST_GOST && - sr.length < 4 + ISC_GOST_DIGESTLENGTH) || - (sr.base[3] == DNS_DSDIGEST_SHA384 && - sr.length < 4 + ISC_SHA384_DIGESTLENGTH)) - return (ISC_R_UNEXPECTEDEND); - - /* - * Only copy digest lengths if we know them. - * If there is extra data dns_rdata_fromwire() will - * detect that. - */ - if (sr.base[3] == DNS_DSDIGEST_SHA1) - sr.length = 4 + ISC_SHA1_DIGESTLENGTH; - else if (sr.base[3] == DNS_DSDIGEST_SHA256) - sr.length = 4 + ISC_SHA256_DIGESTLENGTH; - else if (sr.base[3] == DNS_DSDIGEST_GOST) - sr.length = 4 + ISC_GOST_DIGESTLENGTH; - else if (sr.base[3] == DNS_DSDIGEST_SHA384) - sr.length = 4 + ISC_SHA384_DIGESTLENGTH; - - isc_buffer_forward(source, sr.length); - return (mem_tobuffer(target, sr.base, sr.length)); + return (generic_fromwire_ds(rdclass, type, source, dctx, options, + target)); } static inline isc_result_t @@ -223,66 +86,23 @@ compare_dlv(ARGS_COMPARE) { static inline isc_result_t fromstruct_dlv(ARGS_FROMSTRUCT) { - dns_rdata_dlv_t *dlv = source; REQUIRE(type == dns_rdatatype_dlv); - REQUIRE(source != NULL); - REQUIRE(dlv->common.rdtype == type); - REQUIRE(dlv->common.rdclass == rdclass); - switch (dlv->digest_type) { - case DNS_DSDIGEST_SHA1: - REQUIRE(dlv->length == ISC_SHA1_DIGESTLENGTH); - break; - case DNS_DSDIGEST_SHA256: - REQUIRE(dlv->length == ISC_SHA256_DIGESTLENGTH); - break; - case DNS_DSDIGEST_GOST: - REQUIRE(dlv->length == ISC_GOST_DIGESTLENGTH); - break; - case DNS_DSDIGEST_SHA384: - REQUIRE(dlv->length == ISC_SHA384_DIGESTLENGTH); - break; - } - - UNUSED(type); - UNUSED(rdclass); - - RETERR(uint16_tobuffer(dlv->key_tag, target)); - RETERR(uint8_tobuffer(dlv->algorithm, target)); - RETERR(uint8_tobuffer(dlv->digest_type, target)); - return (mem_tobuffer(target, dlv->digest, dlv->length)); + return (generic_fromstruct_ds(rdclass, type, source, target)); } static inline isc_result_t tostruct_dlv(ARGS_TOSTRUCT) { dns_rdata_dlv_t *dlv = target; - isc_region_t region; REQUIRE(rdata->type == dns_rdatatype_dlv); - REQUIRE(target != NULL); - REQUIRE(rdata->length != 0); dlv->common.rdclass = rdata->rdclass; dlv->common.rdtype = rdata->type; ISC_LINK_INIT(&dlv->common, link); - dns_rdata_toregion(rdata, ®ion); - - dlv->key_tag = uint16_fromregion(®ion); - isc_region_consume(®ion, 2); - dlv->algorithm = uint8_fromregion(®ion); - isc_region_consume(®ion, 1); - dlv->digest_type = uint8_fromregion(®ion); - isc_region_consume(®ion, 1); - dlv->length = region.length; - - dlv->digest = mem_maybedup(mctx, region.base, region.length); - if (dlv->digest == NULL) - return (ISC_R_NOMEMORY); - - dlv->mctx = mctx; - return (ISC_R_SUCCESS); + return (generic_tostruct_ds(rdata, target, mctx)); } static inline void diff --git a/contrib/bind9/lib/dns/rdata/generic/dlv_32769.h b/contrib/bind9/lib/dns/rdata/generic/dlv_32769.h index 2313c5758..404b2856c 100644 --- a/contrib/bind9/lib/dns/rdata/generic/dlv_32769.h +++ b/contrib/bind9/lib/dns/rdata/generic/dlv_32769.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2006, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2006, 2007, 2015 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -20,14 +20,6 @@ #ifndef GENERIC_DLV_32769_H #define GENERIC_DLV_32769_H 1 -typedef struct dns_rdata_dlv { - dns_rdatacommon_t common; - isc_mem_t *mctx; - isc_uint16_t key_tag; - isc_uint8_t algorithm; - isc_uint8_t digest_type; - isc_uint16_t length; - unsigned char *digest; -} dns_rdata_dlv_t; +typedef struct dns_rdata_ds dns_rdata_dlv_t; #endif /* GENERIC_DLV_32769_H */ diff --git a/contrib/bind9/lib/dns/rdata/generic/dname_39.c b/contrib/bind9/lib/dns/rdata/generic/dname_39.c index d181a6cd1..e061161f7 100644 --- a/contrib/bind9/lib/dns/rdata/generic/dname_39.c +++ b/contrib/bind9/lib/dns/rdata/generic/dname_39.c @@ -43,7 +43,8 @@ fromtext_dname(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); return (ISC_R_SUCCESS); } diff --git a/contrib/bind9/lib/dns/rdata/generic/dnskey_48.c b/contrib/bind9/lib/dns/rdata/generic/dnskey_48.c index 3b0387503..41afd57fe 100644 --- a/contrib/bind9/lib/dns/rdata/generic/dnskey_48.c +++ b/contrib/bind9/lib/dns/rdata/generic/dnskey_48.c @@ -32,186 +32,36 @@ static inline isc_result_t fromtext_dnskey(ARGS_FROMTEXT) { - isc_result_t result; - isc_token_t token; - dns_secalg_t alg; - dns_secproto_t proto; - dns_keyflags_t flags; REQUIRE(type == dns_rdatatype_dnskey); - UNUSED(type); - UNUSED(rdclass); - UNUSED(origin); - UNUSED(options); - UNUSED(callbacks); - - /* flags */ - RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, - ISC_FALSE)); - RETTOK(dns_keyflags_fromtext(&flags, &token.value.as_textregion)); - RETERR(uint16_tobuffer(flags, target)); - - /* protocol */ - RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, - ISC_FALSE)); - RETTOK(dns_secproto_fromtext(&proto, &token.value.as_textregion)); - RETERR(mem_tobuffer(target, &proto, 1)); - - /* algorithm */ - RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, - ISC_FALSE)); - RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion)); - RETERR(mem_tobuffer(target, &alg, 1)); - - /* No Key? */ - if ((flags & 0xc000) == 0xc000) - return (ISC_R_SUCCESS); - - result = isc_base64_tobuffer(lexer, target, -1); - if (result != ISC_R_SUCCESS) - return (result); - - /* Ensure there's at least enough data to compute a key ID for MD5 */ - if (alg == DST_ALG_RSAMD5 && isc_buffer_usedlength(target) < 7) - return (ISC_R_UNEXPECTEDEND); - - return (ISC_R_SUCCESS); + return (generic_fromtext_key(rdclass, type, lexer, origin, + options, target, callbacks)); } static inline isc_result_t totext_dnskey(ARGS_TOTEXT) { - isc_region_t sr; - char buf[sizeof("64000")]; - unsigned int flags; - unsigned char algorithm; - char algbuf[DNS_NAME_FORMATSIZE]; - const char *keyinfo; + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_dnskey); - REQUIRE(rdata->length != 0); - - dns_rdata_toregion(rdata, &sr); - /* flags */ - flags = uint16_fromregion(&sr); - isc_region_consume(&sr, 2); - sprintf(buf, "%u", flags); - RETERR(str_totext(buf, target)); - RETERR(str_totext(" ", target)); - if ((flags & DNS_KEYFLAG_KSK) != 0) { - if (flags & DNS_KEYFLAG_REVOKE) - keyinfo = "revoked KSK"; - else - keyinfo = "KSK"; - } else - keyinfo = "ZSK"; - - /* protocol */ - sprintf(buf, "%u", sr.base[0]); - isc_region_consume(&sr, 1); - RETERR(str_totext(buf, target)); - RETERR(str_totext(" ", target)); - - /* algorithm */ - algorithm = sr.base[0]; - sprintf(buf, "%u", algorithm); - isc_region_consume(&sr, 1); - RETERR(str_totext(buf, target)); - - /* No Key? */ - if ((flags & 0xc000) == 0xc000) - return (ISC_R_SUCCESS); - - if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0 && - algorithm == DNS_KEYALG_PRIVATEDNS) { - dns_name_t name; - dns_name_init(&name, NULL); - dns_name_fromregion(&name, &sr); - dns_name_format(&name, algbuf, sizeof(algbuf)); - } else { - dns_secalg_format((dns_secalg_t) algorithm, algbuf, - sizeof(algbuf)); - } - - /* key */ - if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) - RETERR(str_totext(" (", target)); - RETERR(str_totext(tctx->linebreak, target)); - if (tctx->width == 0) /* No splitting */ - RETERR(isc_base64_totext(&sr, 0, "", target)); - else - RETERR(isc_base64_totext(&sr, tctx->width - 2, - tctx->linebreak, target)); - - if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) - RETERR(str_totext(tctx->linebreak, target)); - else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) - RETERR(str_totext(" ", target)); - - if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) - RETERR(str_totext(")", target)); - - if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) { - isc_region_t tmpr; - - RETERR(str_totext(" ; ", target)); - RETERR(str_totext(keyinfo, target)); - RETERR(str_totext("; alg = ", target)); - RETERR(str_totext(algbuf, target)); - RETERR(str_totext("; key id = ", target)); - dns_rdata_toregion(rdata, &tmpr); - sprintf(buf, "%u", dst_region_computeid(&tmpr, algorithm)); - RETERR(str_totext(buf, target)); - } - return (ISC_R_SUCCESS); + return (generic_totext_key(rdata, tctx, target)); } static inline isc_result_t fromwire_dnskey(ARGS_FROMWIRE) { - unsigned char algorithm; - isc_region_t sr; REQUIRE(type == dns_rdatatype_dnskey); - UNUSED(type); - UNUSED(rdclass); - UNUSED(dctx); - UNUSED(options); - - isc_buffer_activeregion(source, &sr); - if (sr.length < 4) - return (ISC_R_UNEXPECTEDEND); - - algorithm = sr.base[3]; - RETERR(mem_tobuffer(target, sr.base, 4)); - isc_region_consume(&sr, 4); - isc_buffer_forward(source, 4); - - if (algorithm == DNS_KEYALG_PRIVATEDNS) { - dns_name_t name; - dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE); - dns_name_init(&name, NULL); - RETERR(dns_name_fromwire(&name, source, dctx, options, target)); - } - - /* - * RSAMD5 computes key ID differently from other - * algorithms: we need to ensure there's enough data - * present for the computation - */ - if (algorithm == DST_ALG_RSAMD5 && sr.length < 3) - return (ISC_R_UNEXPECTEDEND); - - isc_buffer_activeregion(source, &sr); - isc_buffer_forward(source, sr.length); - return (mem_tobuffer(target, sr.base, sr.length)); + return (generic_fromwire_key(rdclass, type, source, dctx, + options, target)); } static inline isc_result_t towire_dnskey(ARGS_TOWIRE) { isc_region_t sr; + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_dnskey); REQUIRE(rdata->length != 0); @@ -226,6 +76,8 @@ compare_dnskey(ARGS_COMPARE) { isc_region_t r1; isc_region_t r2; + REQUIRE(rdata1 != NULL); + REQUIRE(rdata2 != NULL); REQUIRE(rdata1->type == rdata2->type); REQUIRE(rdata1->rdclass == rdata2->rdclass); REQUIRE(rdata1->type == dns_rdatatype_dnskey); @@ -239,89 +91,40 @@ compare_dnskey(ARGS_COMPARE) { static inline isc_result_t fromstruct_dnskey(ARGS_FROMSTRUCT) { - dns_rdata_dnskey_t *dnskey = source; REQUIRE(type == dns_rdatatype_dnskey); - REQUIRE(source != NULL); - REQUIRE(dnskey->common.rdtype == type); - REQUIRE(dnskey->common.rdclass == rdclass); - - UNUSED(type); - UNUSED(rdclass); - - /* Flags */ - RETERR(uint16_tobuffer(dnskey->flags, target)); - - /* Protocol */ - RETERR(uint8_tobuffer(dnskey->protocol, target)); - /* Algorithm */ - RETERR(uint8_tobuffer(dnskey->algorithm, target)); - - /* Data */ - return (mem_tobuffer(target, dnskey->data, dnskey->datalen)); + return (generic_fromstruct_key(rdclass, type, source, target)); } static inline isc_result_t tostruct_dnskey(ARGS_TOSTRUCT) { dns_rdata_dnskey_t *dnskey = target; - isc_region_t sr; + REQUIRE(dnskey != NULL); + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_dnskey); - REQUIRE(target != NULL); - REQUIRE(rdata->length != 0); dnskey->common.rdclass = rdata->rdclass; dnskey->common.rdtype = rdata->type; ISC_LINK_INIT(&dnskey->common, link); - dns_rdata_toregion(rdata, &sr); - - /* Flags */ - if (sr.length < 2) - return (ISC_R_UNEXPECTEDEND); - dnskey->flags = uint16_fromregion(&sr); - isc_region_consume(&sr, 2); - - /* Protocol */ - if (sr.length < 1) - return (ISC_R_UNEXPECTEDEND); - dnskey->protocol = uint8_fromregion(&sr); - isc_region_consume(&sr, 1); - - /* Algorithm */ - if (sr.length < 1) - return (ISC_R_UNEXPECTEDEND); - dnskey->algorithm = uint8_fromregion(&sr); - isc_region_consume(&sr, 1); - - /* Data */ - dnskey->datalen = sr.length; - dnskey->data = mem_maybedup(mctx, sr.base, dnskey->datalen); - if (dnskey->data == NULL) - return (ISC_R_NOMEMORY); - - dnskey->mctx = mctx; - return (ISC_R_SUCCESS); + return (generic_tostruct_key(rdata, target, mctx)); } static inline void freestruct_dnskey(ARGS_FREESTRUCT) { dns_rdata_dnskey_t *dnskey = (dns_rdata_dnskey_t *) source; - REQUIRE(source != NULL); + REQUIRE(dnskey != NULL); REQUIRE(dnskey->common.rdtype == dns_rdatatype_dnskey); - if (dnskey->mctx == NULL) - return; - - if (dnskey->data != NULL) - isc_mem_free(dnskey->mctx, dnskey->data); - dnskey->mctx = NULL; + generic_freestruct_key(source); } static inline isc_result_t additionaldata_dnskey(ARGS_ADDLDATA) { + REQUIRE(rdata->type == dns_rdatatype_dnskey); UNUSED(rdata); @@ -335,6 +138,7 @@ static inline isc_result_t digest_dnskey(ARGS_DIGEST) { isc_region_t r; + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_dnskey); dns_rdata_toregion(rdata, &r); @@ -358,6 +162,7 @@ checkowner_dnskey(ARGS_CHECKOWNER) { static inline isc_boolean_t checknames_dnskey(ARGS_CHECKNAMES) { + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_dnskey); UNUSED(rdata); diff --git a/contrib/bind9/lib/dns/rdata/generic/dnskey_48.h b/contrib/bind9/lib/dns/rdata/generic/dnskey_48.h index ce88cd1bf..67b1d7a35 100644 --- a/contrib/bind9/lib/dns/rdata/generic/dnskey_48.h +++ b/contrib/bind9/lib/dns/rdata/generic/dnskey_48.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -18,20 +18,10 @@ #ifndef GENERIC_DNSKEY_48_H #define GENERIC_DNSKEY_48_H 1 -/* $Id: dnskey_48.h,v 1.7 2007/06/19 23:47:17 tbox Exp $ */ - /*! - * \brief per RFC2535 */ - -typedef struct dns_rdata_dnskey { - dns_rdatacommon_t common; - isc_mem_t * mctx; - isc_uint16_t flags; - isc_uint8_t protocol; - isc_uint8_t algorithm; - isc_uint16_t datalen; - unsigned char * data; -} dns_rdata_dnskey_t; + * \brief per RFC2535 + */ +typedef struct dns_rdata_key dns_rdata_dnskey_t; #endif /* GENERIC_DNSKEY_48_H */ diff --git a/contrib/bind9/lib/dns/rdata/generic/ds_43.c b/contrib/bind9/lib/dns/rdata/generic/ds_43.c index 975fdfd2b..cdaec4dba 100644 --- a/contrib/bind9/lib/dns/rdata/generic/ds_43.c +++ b/contrib/bind9/lib/dns/rdata/generic/ds_43.c @@ -31,13 +31,11 @@ #include static inline isc_result_t -fromtext_ds(ARGS_FROMTEXT) { +generic_fromtext_ds(ARGS_FROMTEXT) { isc_token_t token; unsigned char c; int length; - REQUIRE(type == dns_rdatatype_ds); - UNUSED(type); UNUSED(rdclass); UNUSED(origin); @@ -95,12 +93,20 @@ fromtext_ds(ARGS_FROMTEXT) { } static inline isc_result_t -totext_ds(ARGS_TOTEXT) { +fromtext_ds(ARGS_FROMTEXT) { + + REQUIRE(type == dns_rdatatype_ds); + + return (generic_fromtext_ds(rdclass, type, lexer, origin, options, + target, callbacks)); +} + +static inline isc_result_t +generic_totext_ds(ARGS_TOTEXT) { isc_region_t sr; char buf[sizeof("64000 ")]; unsigned int n; - REQUIRE(rdata->type == dns_rdatatype_ds); REQUIRE(rdata->length != 0); UNUSED(tctx); @@ -148,10 +154,16 @@ totext_ds(ARGS_TOTEXT) { } static inline isc_result_t -fromwire_ds(ARGS_FROMWIRE) { - isc_region_t sr; +totext_ds(ARGS_TOTEXT) { - REQUIRE(type == dns_rdatatype_ds); + REQUIRE(rdata->type == dns_rdatatype_ds); + + return (generic_totext_ds(rdata, tctx, target)); +} + +static inline isc_result_t +generic_fromwire_ds(ARGS_FROMWIRE) { + isc_region_t sr; UNUSED(type); UNUSED(rdclass); @@ -192,6 +204,15 @@ fromwire_ds(ARGS_FROMWIRE) { return (mem_tobuffer(target, sr.base, sr.length)); } +static inline isc_result_t +fromwire_ds(ARGS_FROMWIRE) { + + REQUIRE(type == dns_rdatatype_ds); + + return (generic_fromwire_ds(rdclass, type, source, dctx, options, + target)); +} + static inline isc_result_t towire_ds(ARGS_TOWIRE) { isc_region_t sr; @@ -222,13 +243,16 @@ compare_ds(ARGS_COMPARE) { } static inline isc_result_t -fromstruct_ds(ARGS_FROMSTRUCT) { +generic_fromstruct_ds(ARGS_FROMSTRUCT) { dns_rdata_ds_t *ds = source; - REQUIRE(type == dns_rdatatype_ds); REQUIRE(source != NULL); REQUIRE(ds->common.rdtype == type); REQUIRE(ds->common.rdclass == rdclass); + + UNUSED(type); + UNUSED(rdclass); + switch (ds->digest_type) { case DNS_DSDIGEST_SHA1: REQUIRE(ds->length == ISC_SHA1_DIGESTLENGTH); @@ -244,9 +268,6 @@ fromstruct_ds(ARGS_FROMSTRUCT) { break; } - UNUSED(type); - UNUSED(rdclass); - RETERR(uint16_tobuffer(ds->key_tag, target)); RETERR(uint8_tobuffer(ds->algorithm, target)); RETERR(uint8_tobuffer(ds->digest_type, target)); @@ -255,17 +276,23 @@ fromstruct_ds(ARGS_FROMSTRUCT) { } static inline isc_result_t -tostruct_ds(ARGS_TOSTRUCT) { +fromstruct_ds(ARGS_FROMSTRUCT) { + + REQUIRE(type == dns_rdatatype_ds); + + return (generic_fromstruct_ds(rdclass, type, source, target)); +} + +static inline isc_result_t +generic_tostruct_ds(ARGS_TOSTRUCT) { dns_rdata_ds_t *ds = target; isc_region_t region; - REQUIRE(rdata->type == dns_rdatatype_ds); REQUIRE(target != NULL); REQUIRE(rdata->length != 0); - - ds->common.rdclass = rdata->rdclass; - ds->common.rdtype = rdata->type; - ISC_LINK_INIT(&ds->common, link); + REQUIRE(ds->common.rdtype == rdata->type); + REQUIRE(ds->common.rdclass == rdata->rdclass); + REQUIRE(!ISC_LINK_LINKED(&ds->common, link)); dns_rdata_toregion(rdata, ®ion); @@ -285,6 +312,20 @@ tostruct_ds(ARGS_TOSTRUCT) { return (ISC_R_SUCCESS); } +static inline isc_result_t +tostruct_ds(ARGS_TOSTRUCT) { + dns_rdata_ds_t *ds = target; + + REQUIRE(rdata->type == dns_rdatatype_ds); + REQUIRE(target != NULL); + + ds->common.rdclass = rdata->rdclass; + ds->common.rdtype = rdata->type; + ISC_LINK_INIT(&ds->common, link); + + return (generic_tostruct_ds(rdata, target, mctx)); +} + static inline void freestruct_ds(ARGS_FREESTRUCT) { dns_rdata_ds_t *ds = source; diff --git a/contrib/bind9/lib/dns/rdata/generic/hip_55.c b/contrib/bind9/lib/dns/rdata/generic/hip_55.c index 7c51d1f72..8e7002298 100644 --- a/contrib/bind9/lib/dns/rdata/generic/hip_55.c +++ b/contrib/bind9/lib/dns/rdata/generic/hip_55.c @@ -94,6 +94,9 @@ fromtext_hip(ARGS_FROMTEXT) { RETTOK(ISC_R_RANGE); RETERR(uint16_tobuffer((isc_uint32_t)len, &key_len)); + if (origin == NULL) + origin = dns_rootname; + /* * Rendezvous Servers. */ @@ -105,7 +108,6 @@ fromtext_hip(ARGS_FROMTEXT) { if (token.type != isc_tokentype_string) break; buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); } while (1); diff --git a/contrib/bind9/lib/dns/rdata/generic/ipseckey_45.c b/contrib/bind9/lib/dns/rdata/generic/ipseckey_45.c index c5462c1a6..cc6fb6d40 100644 --- a/contrib/bind9/lib/dns/rdata/generic/ipseckey_45.c +++ b/contrib/bind9/lib/dns/rdata/generic/ipseckey_45.c @@ -104,7 +104,8 @@ fromtext_ipseckey(ARGS_FROMTEXT) { case 3: dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); break; diff --git a/contrib/bind9/lib/dns/rdata/generic/key_25.c b/contrib/bind9/lib/dns/rdata/generic/key_25.c index c2ddd57fc..4c65408ce 100644 --- a/contrib/bind9/lib/dns/rdata/generic/key_25.c +++ b/contrib/bind9/lib/dns/rdata/generic/key_25.c @@ -31,15 +31,13 @@ #define RRTYPE_KEY_ATTRIBUTES (0) static inline isc_result_t -fromtext_key(ARGS_FROMTEXT) { +generic_fromtext_key(ARGS_FROMTEXT) { isc_result_t result; isc_token_t token; dns_secalg_t alg; dns_secproto_t proto; dns_keyflags_t flags; - REQUIRE(type == dns_rdatatype_key); - UNUSED(type); UNUSED(rdclass); UNUSED(origin); @@ -80,14 +78,15 @@ fromtext_key(ARGS_FROMTEXT) { } static inline isc_result_t -totext_key(ARGS_TOTEXT) { +generic_totext_key(ARGS_TOTEXT) { isc_region_t sr; - char buf[sizeof("64000")]; + char buf[sizeof("[key id = 64000]")]; unsigned int flags; unsigned char algorithm; - char namebuf[DNS_NAME_FORMATSIZE]; + char algbuf[DNS_NAME_FORMATSIZE]; + const char *keyinfo; + isc_region_t tmpr; - REQUIRE(rdata->type == dns_rdatatype_key); REQUIRE(rdata->length != 0); dns_rdata_toregion(rdata, &sr); @@ -98,6 +97,14 @@ totext_key(ARGS_TOTEXT) { sprintf(buf, "%u", flags); RETERR(str_totext(buf, target)); RETERR(str_totext(" ", target)); + if ((flags & DNS_KEYFLAG_KSK) != 0) { + if (flags & DNS_KEYFLAG_REVOKE) + keyinfo = "revoked KSK"; + else + keyinfo = "KSK"; + } else + keyinfo = "ZSK"; + /* protocol */ sprintf(buf, "%u", sr.base[0]); @@ -120,19 +127,22 @@ totext_key(ARGS_TOTEXT) { dns_name_t name; dns_name_init(&name, NULL); dns_name_fromregion(&name, &sr); - dns_name_format(&name, namebuf, sizeof(namebuf)); - } else - namebuf[0] = 0; + dns_name_format(&name, algbuf, sizeof(algbuf)); + } else { + dns_secalg_format((dns_secalg_t) algorithm, algbuf, + sizeof(algbuf)); + } /* key */ if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" (", target)); RETERR(str_totext(tctx->linebreak, target)); + if (tctx->width == 0) /* No splitting */ RETERR(isc_base64_totext(&sr, 60, "", target)); else RETERR(isc_base64_totext(&sr, tctx->width - 2, - tctx->linebreak, target)); + tctx->linebreak, target)); if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) RETERR(str_totext(tctx->linebreak, target)); @@ -143,28 +153,27 @@ totext_key(ARGS_TOTEXT) { RETERR(str_totext(")", target)); if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) { - isc_region_t tmpr; + if (rdata->type == dns_rdatatype_dnskey || + rdata->type == dns_rdatatype_cdnskey) { + RETERR(str_totext(" ; ", target)); + RETERR(str_totext(keyinfo, target)); + } + RETERR(str_totext("; alg = ", target)); + RETERR(str_totext(algbuf, target)); RETERR(str_totext(" ; key id = ", target)); dns_rdata_toregion(rdata, &tmpr); sprintf(buf, "%u", dst_region_computeid(&tmpr, algorithm)); RETERR(str_totext(buf, target)); - if (algorithm == DNS_KEYALG_PRIVATEDNS) { - RETERR(str_totext(tctx->linebreak, target)); - RETERR(str_totext("; alg = ", target)); - RETERR(str_totext(namebuf, target)); - } } return (ISC_R_SUCCESS); } static inline isc_result_t -fromwire_key(ARGS_FROMWIRE) { +generic_fromwire_key(ARGS_FROMWIRE) { unsigned char algorithm; isc_region_t sr; - REQUIRE(type == dns_rdatatype_key); - UNUSED(type); UNUSED(rdclass); UNUSED(dctx); @@ -199,10 +208,38 @@ fromwire_key(ARGS_FROMWIRE) { return (mem_tobuffer(target, sr.base, sr.length)); } +static inline isc_result_t +fromtext_key(ARGS_FROMTEXT) { + + REQUIRE(type == dns_rdatatype_key); + + return (generic_fromtext_key(rdclass, type, lexer, origin, + options, target, callbacks)); +} + +static inline isc_result_t +totext_key(ARGS_TOTEXT) { + + REQUIRE(rdata != NULL); + REQUIRE(rdata->type == dns_rdatatype_key); + + return (generic_totext_key(rdata, tctx, target)); +} + +static inline isc_result_t +fromwire_key(ARGS_FROMWIRE) { + + REQUIRE(type == dns_rdatatype_key); + + return (generic_fromwire_key(rdclass, type, source, dctx, + options, target)); +} + static inline isc_result_t towire_key(ARGS_TOWIRE) { isc_region_t sr; + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_key); REQUIRE(rdata->length != 0); @@ -217,6 +254,8 @@ compare_key(ARGS_COMPARE) { isc_region_t r1; isc_region_t r2; + REQUIRE(rdata1 != NULL); + REQUIRE(rdata2 != NULL); REQUIRE(rdata1->type == rdata2->type); REQUIRE(rdata1->rdclass == rdata2->rdclass); REQUIRE(rdata1->type == dns_rdatatype_key); @@ -229,11 +268,10 @@ compare_key(ARGS_COMPARE) { } static inline isc_result_t -fromstruct_key(ARGS_FROMSTRUCT) { +generic_fromstruct_key(ARGS_FROMSTRUCT) { dns_rdata_key_t *key = source; - REQUIRE(type == dns_rdatatype_key); - REQUIRE(source != NULL); + REQUIRE(key != NULL); REQUIRE(key->common.rdtype == type); REQUIRE(key->common.rdclass == rdclass); @@ -254,17 +292,17 @@ fromstruct_key(ARGS_FROMSTRUCT) { } static inline isc_result_t -tostruct_key(ARGS_TOSTRUCT) { +generic_tostruct_key(ARGS_TOSTRUCT) { dns_rdata_key_t *key = target; isc_region_t sr; - REQUIRE(rdata->type == dns_rdatatype_key); - REQUIRE(target != NULL); + REQUIRE(rdata != NULL); REQUIRE(rdata->length != 0); - key->common.rdclass = rdata->rdclass; - key->common.rdtype = rdata->type; - ISC_LINK_INIT(&key->common, link); + REQUIRE(key != NULL); + REQUIRE(key->common.rdclass == rdata->rdclass); + REQUIRE(key->common.rdtype == rdata->type); + REQUIRE(!ISC_LINK_LINKED(&key->common, link)); dns_rdata_toregion(rdata, &sr); @@ -297,11 +335,10 @@ tostruct_key(ARGS_TOSTRUCT) { } static inline void -freestruct_key(ARGS_FREESTRUCT) { +generic_freestruct_key(ARGS_FREESTRUCT) { dns_rdata_key_t *key = (dns_rdata_key_t *) source; - REQUIRE(source != NULL); - REQUIRE(key->common.rdtype == dns_rdatatype_key); + REQUIRE(key != NULL); if (key->mctx == NULL) return; @@ -311,8 +348,43 @@ freestruct_key(ARGS_FREESTRUCT) { key->mctx = NULL; } +static inline isc_result_t +fromstruct_key(ARGS_FROMSTRUCT) { + + REQUIRE(type == dns_rdatatype_key); + + return (generic_fromstruct_key(rdclass, type, source, target)); +} + +static inline isc_result_t +tostruct_key(ARGS_TOSTRUCT) { + dns_rdata_key_t *key = target; + + REQUIRE(key != NULL); + REQUIRE(rdata != NULL); + REQUIRE(rdata->type == dns_rdatatype_key); + + key->common.rdclass = rdata->rdclass; + key->common.rdtype = rdata->type; + ISC_LINK_INIT(&key->common, link); + + return (generic_tostruct_key(rdata, target, mctx)); +} + +static inline void +freestruct_key(ARGS_FREESTRUCT) { + dns_rdata_key_t *key = (dns_rdata_key_t *) source; + + REQUIRE(key != NULL); + REQUIRE(key->common.rdtype == dns_rdatatype_key); + + generic_freestruct_key(source); +} + static inline isc_result_t additionaldata_key(ARGS_ADDLDATA) { + + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_key); UNUSED(rdata); @@ -326,6 +398,7 @@ static inline isc_result_t digest_key(ARGS_DIGEST) { isc_region_t r; + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_key); dns_rdata_toregion(rdata, &r); @@ -349,6 +422,7 @@ checkowner_key(ARGS_CHECKOWNER) { static inline isc_boolean_t checknames_key(ARGS_CHECKNAMES) { + REQUIRE(rdata != NULL); REQUIRE(rdata->type == dns_rdatatype_key); UNUSED(rdata); diff --git a/contrib/bind9/lib/dns/rdata/generic/key_25.h b/contrib/bind9/lib/dns/rdata/generic/key_25.h index bcf9cb6a2..e3aa8beae 100644 --- a/contrib/bind9/lib/dns/rdata/generic/key_25.h +++ b/contrib/bind9/lib/dns/rdata/generic/key_25.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -23,14 +23,14 @@ /*! * \brief Per RFC2535 */ -typedef struct dns_rdata_key_t { - dns_rdatacommon_t common; - isc_mem_t * mctx; - isc_uint16_t flags; - isc_uint8_t protocol; - isc_uint8_t algorithm; - isc_uint16_t datalen; - unsigned char * data; +typedef struct dns_rdata_key { + dns_rdatacommon_t common; + isc_mem_t * mctx; + isc_uint16_t flags; + isc_uint8_t protocol; + isc_uint8_t algorithm; + isc_uint16_t datalen; + unsigned char * data; } dns_rdata_key_t; diff --git a/contrib/bind9/lib/dns/rdata/generic/lp_107.c b/contrib/bind9/lib/dns/rdata/generic/lp_107.c index 08d6b1763..b9e2f039f 100644 --- a/contrib/bind9/lib/dns/rdata/generic/lp_107.c +++ b/contrib/bind9/lib/dns/rdata/generic/lp_107.c @@ -46,7 +46,8 @@ fromtext_lp(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; return (dns_name_fromtext(&name, &buffer, origin, options, target)); } diff --git a/contrib/bind9/lib/dns/rdata/generic/mb_7.c b/contrib/bind9/lib/dns/rdata/generic/mb_7.c index 47c7308eb..cd92af512 100644 --- a/contrib/bind9/lib/dns/rdata/generic/mb_7.c +++ b/contrib/bind9/lib/dns/rdata/generic/mb_7.c @@ -41,7 +41,8 @@ fromtext_mb(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); return (ISC_R_SUCCESS); } diff --git a/contrib/bind9/lib/dns/rdata/generic/md_3.c b/contrib/bind9/lib/dns/rdata/generic/md_3.c index 7485d1e49..9738878aa 100644 --- a/contrib/bind9/lib/dns/rdata/generic/md_3.c +++ b/contrib/bind9/lib/dns/rdata/generic/md_3.c @@ -41,7 +41,8 @@ fromtext_md(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); return (ISC_R_SUCCESS); } diff --git a/contrib/bind9/lib/dns/rdata/generic/mf_4.c b/contrib/bind9/lib/dns/rdata/generic/mf_4.c index 97402a9dc..f7513fdbe 100644 --- a/contrib/bind9/lib/dns/rdata/generic/mf_4.c +++ b/contrib/bind9/lib/dns/rdata/generic/mf_4.c @@ -41,7 +41,8 @@ fromtext_mf(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); return (ISC_R_SUCCESS); } diff --git a/contrib/bind9/lib/dns/rdata/generic/mg_8.c b/contrib/bind9/lib/dns/rdata/generic/mg_8.c index 6c3b7e2b2..3f50a9ed3 100644 --- a/contrib/bind9/lib/dns/rdata/generic/mg_8.c +++ b/contrib/bind9/lib/dns/rdata/generic/mg_8.c @@ -41,7 +41,8 @@ fromtext_mg(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); return (ISC_R_SUCCESS); } diff --git a/contrib/bind9/lib/dns/rdata/generic/minfo_14.c b/contrib/bind9/lib/dns/rdata/generic/minfo_14.c index 2a868f857..173567ef6 100644 --- a/contrib/bind9/lib/dns/rdata/generic/minfo_14.c +++ b/contrib/bind9/lib/dns/rdata/generic/minfo_14.c @@ -38,13 +38,15 @@ fromtext_minfo(ARGS_FROMTEXT) { UNUSED(rdclass); UNUSED(callbacks); + if (origin == NULL) + origin = dns_rootname; + for (i = 0; i < 2; i++) { RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); ok = ISC_TRUE; diff --git a/contrib/bind9/lib/dns/rdata/generic/mr_9.c b/contrib/bind9/lib/dns/rdata/generic/mr_9.c index 7e69cf1cf..c82ad2188 100644 --- a/contrib/bind9/lib/dns/rdata/generic/mr_9.c +++ b/contrib/bind9/lib/dns/rdata/generic/mr_9.c @@ -41,7 +41,8 @@ fromtext_mr(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); return (ISC_R_SUCCESS); } diff --git a/contrib/bind9/lib/dns/rdata/generic/mx_15.c b/contrib/bind9/lib/dns/rdata/generic/mx_15.c index 7364b4ac1..37fd7e6e5 100644 --- a/contrib/bind9/lib/dns/rdata/generic/mx_15.c +++ b/contrib/bind9/lib/dns/rdata/generic/mx_15.c @@ -77,7 +77,8 @@ fromtext_mx(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); ok = ISC_TRUE; if ((options & DNS_RDATA_CHECKNAMES) != 0) diff --git a/contrib/bind9/lib/dns/rdata/generic/naptr_35.c b/contrib/bind9/lib/dns/rdata/generic/naptr_35.c index e8cbda87b..418a9d25f 100644 --- a/contrib/bind9/lib/dns/rdata/generic/naptr_35.c +++ b/contrib/bind9/lib/dns/rdata/generic/naptr_35.c @@ -181,7 +181,8 @@ fromtext_naptr(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); return (ISC_R_SUCCESS); } diff --git a/contrib/bind9/lib/dns/rdata/generic/ninfo_56.c b/contrib/bind9/lib/dns/rdata/generic/ninfo_56.c new file mode 100644 index 000000000..f31f47ed6 --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/ninfo_56.c @@ -0,0 +1,196 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef RDATA_GENERIC_NINFO_56_C +#define RDATA_GENERIC_NINFO_56_C + +#define RRTYPE_NINFO_ATTRIBUTES (0) + +static inline isc_result_t +fromtext_ninfo(ARGS_FROMTEXT) { + + REQUIRE(type == dns_rdatatype_ninfo); + + UNUSED(type); + UNUSED(rdclass); + UNUSED(origin); + UNUSED(options); + UNUSED(callbacks); + + return (generic_fromtext_txt(rdclass, type, lexer, origin, options, + target, callbacks)); +} + +static inline isc_result_t +totext_ninfo(ARGS_TOTEXT) { + + UNUSED(tctx); + + REQUIRE(rdata->type == dns_rdatatype_ninfo); + + return (generic_totext_txt(rdata, tctx, target)); +} + +static inline isc_result_t +fromwire_ninfo(ARGS_FROMWIRE) { + + REQUIRE(type == dns_rdatatype_ninfo); + + UNUSED(type); + UNUSED(dctx); + UNUSED(rdclass); + UNUSED(options); + + return (generic_fromwire_txt(rdclass, type, source, dctx, options, + target)); +} + +static inline isc_result_t +towire_ninfo(ARGS_TOWIRE) { + + REQUIRE(rdata->type == dns_rdatatype_ninfo); + + UNUSED(cctx); + + return (mem_tobuffer(target, rdata->data, rdata->length)); +} + +static inline int +compare_ninfo(ARGS_COMPARE) { + isc_region_t r1; + isc_region_t r2; + + REQUIRE(rdata1->type == rdata2->type); + REQUIRE(rdata1->rdclass == rdata2->rdclass); + REQUIRE(rdata1->type == dns_rdatatype_ninfo); + + dns_rdata_toregion(rdata1, &r1); + dns_rdata_toregion(rdata2, &r2); + return (isc_region_compare(&r1, &r2)); +} + +static inline isc_result_t +fromstruct_ninfo(ARGS_FROMSTRUCT) { + + REQUIRE(type == dns_rdatatype_ninfo); + + return (generic_fromstruct_txt(rdclass, type, source, target)); +} + +static inline isc_result_t +tostruct_ninfo(ARGS_TOSTRUCT) { + dns_rdata_ninfo_t *txt = target; + + REQUIRE(rdata->type == dns_rdatatype_ninfo); + + txt->common.rdclass = rdata->rdclass; + txt->common.rdtype = rdata->type; + ISC_LINK_INIT(&txt->common, link); + + return (generic_tostruct_txt(rdata, target, mctx)); +} + +static inline void +freestruct_ninfo(ARGS_FREESTRUCT) { + dns_rdata_ninfo_t *ninfo = source; + + REQUIRE(source != NULL); + REQUIRE(ninfo->common.rdtype == dns_rdatatype_ninfo); + + generic_freestruct_txt(source); +} + +static inline isc_result_t +additionaldata_ninfo(ARGS_ADDLDATA) { + REQUIRE(rdata->type == dns_rdatatype_ninfo); + + UNUSED(rdata); + UNUSED(add); + UNUSED(arg); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +digest_ninfo(ARGS_DIGEST) { + isc_region_t r; + + REQUIRE(rdata->type == dns_rdatatype_ninfo); + + dns_rdata_toregion(rdata, &r); + + return ((digest)(arg, &r)); +} + +static inline isc_boolean_t +checkowner_ninfo(ARGS_CHECKOWNER) { + + REQUIRE(type == dns_rdatatype_ninfo); + + UNUSED(name); + UNUSED(type); + UNUSED(rdclass); + UNUSED(wildcard); + + return (ISC_TRUE); +} + +static inline isc_boolean_t +checknames_ninfo(ARGS_CHECKNAMES) { + + REQUIRE(rdata->type == dns_rdatatype_ninfo); + + UNUSED(rdata); + UNUSED(owner); + UNUSED(bad); + + return (ISC_TRUE); +} + +static inline isc_result_t +casecompare_ninfo(ARGS_COMPARE) { + return (compare_ninfo(rdata1, rdata2)); +} + +isc_result_t +dns_rdata_ninfo_first(dns_rdata_ninfo_t *ninfo) { + + REQUIRE(ninfo != NULL); + REQUIRE(ninfo->common.rdtype == dns_rdatatype_ninfo); + + return (generic_txt_first(ninfo)); +} + +isc_result_t +dns_rdata_ninfo_next(dns_rdata_ninfo_t *ninfo) { + + REQUIRE(ninfo != NULL); + REQUIRE(ninfo->common.rdtype == dns_rdatatype_ninfo); + + return (generic_txt_next(ninfo)); +} + +isc_result_t +dns_rdata_ninfo_current(dns_rdata_ninfo_t *ninfo, + dns_rdata_ninfo_string_t *string) +{ + + REQUIRE(ninfo != NULL); + REQUIRE(ninfo->common.rdtype == dns_rdatatype_ninfo); + + return (generic_txt_current(ninfo, string)); +} +#endif /* RDATA_GENERIC_NINFO_56_C */ diff --git a/contrib/bind9/lib/dns/rdata/generic/ninfo_56.h b/contrib/bind9/lib/dns/rdata/generic/ninfo_56.h new file mode 100644 index 000000000..343cae387 --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/ninfo_56.h @@ -0,0 +1,39 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* */ +#ifndef GENERIC_NINFO_56_H +#define GENERIC_NINFO_56_H 1 + +typedef struct dns_rdata_txt_string dns_rdata_ninfo_string_t; + +typedef struct dns_rdata_txt dns_rdata_ninfo_t; + +/* + * ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS are already done + * via rdatastructpre.h and rdatastructsuf.h. + */ + +isc_result_t +dns_rdata_ninfo_first(dns_rdata_ninfo_t *); + +isc_result_t +dns_rdata_ninfo_next(dns_rdata_ninfo_t *); + +isc_result_t +dns_rdata_ninfo_current(dns_rdata_ninfo_t *, dns_rdata_ninfo_string_t *); + +#endif /* GENERIC_NINFO_16_H */ diff --git a/contrib/bind9/lib/dns/rdata/generic/ns_2.c b/contrib/bind9/lib/dns/rdata/generic/ns_2.c index d7e095b09..eaac08c28 100644 --- a/contrib/bind9/lib/dns/rdata/generic/ns_2.c +++ b/contrib/bind9/lib/dns/rdata/generic/ns_2.c @@ -42,7 +42,8 @@ fromtext_ns(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); ok = ISC_TRUE; if ((options & DNS_RDATA_CHECKNAMES) != 0) diff --git a/contrib/bind9/lib/dns/rdata/generic/nsec3_50.c b/contrib/bind9/lib/dns/rdata/generic/nsec3_50.c index 2aec339c2..b8245a041 100644 --- a/contrib/bind9/lib/dns/rdata/generic/nsec3_50.c +++ b/contrib/bind9/lib/dns/rdata/generic/nsec3_50.c @@ -45,13 +45,10 @@ static inline isc_result_t fromtext_nsec3(ARGS_FROMTEXT) { isc_token_t token; - unsigned char bm[8*1024]; /* 64k bits */ - dns_rdatatype_t covered; - int octet; - int window; unsigned int flags; unsigned char hashalg; isc_buffer_t b; + unsigned char buf[256]; REQUIRE(type == dns_rdatatype_nsec3); @@ -99,50 +96,24 @@ fromtext_nsec3(ARGS_FROMTEXT) { */ RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, ISC_FALSE)); - isc_buffer_init(&b, bm, sizeof(bm)); + isc_buffer_init(&b, buf, sizeof(buf)); RETTOK(isc_base32hexnp_decodestring(DNS_AS_STR(token), &b)); if (isc_buffer_usedlength(&b) > 0xffU) RETTOK(ISC_R_RANGE); RETERR(uint8_tobuffer(isc_buffer_usedlength(&b), target)); - RETERR(mem_tobuffer(target, &bm, isc_buffer_usedlength(&b))); - - memset(bm, 0, sizeof(bm)); - do { - RETERR(isc_lex_getmastertoken(lexer, &token, - isc_tokentype_string, ISC_TRUE)); - if (token.type != isc_tokentype_string) - break; - RETTOK(dns_rdatatype_fromtext(&covered, - &token.value.as_textregion)); - bm[covered/8] |= (0x80>>(covered%8)); - } while (1); - isc_lex_ungettoken(lexer, &token); - for (window = 0; window < 256 ; window++) { - /* - * Find if we have a type in this window. - */ - for (octet = 31; octet >= 0; octet--) - if (bm[window * 32 + octet] != 0) - break; - if (octet < 0) - continue; - RETERR(uint8_tobuffer(window, target)); - RETERR(uint8_tobuffer(octet + 1, target)); - RETERR(mem_tobuffer(target, &bm[window * 32], octet + 1)); - } - return (ISC_R_SUCCESS); + RETERR(mem_tobuffer(target, &buf, isc_buffer_usedlength(&b))); + + return (typemap_fromtext(lexer, target, ISC_TRUE)); } static inline isc_result_t totext_nsec3(ARGS_TOTEXT) { isc_region_t sr; - unsigned int i, j, k; - unsigned int window, len; + unsigned int i, j; unsigned char hash; unsigned char flags; char buf[sizeof("TYPE65535")]; isc_uint32_t iterations; - isc_boolean_t first; REQUIRE(rdata->type == dns_rdatatype_nsec3); REQUIRE(rdata->length != 0); @@ -197,39 +168,7 @@ totext_nsec3(ARGS_TOTEXT) { if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) == 0) RETERR(str_totext(" ", target)); - /* Types covered */ - first = ISC_TRUE; - for (i = 0; i < sr.length; i += len) { - if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) { - RETERR(str_totext(tctx->linebreak, target)); - first = ISC_TRUE; - } - INSIST(i + 2 <= sr.length); - window = sr.base[i]; - len = sr.base[i + 1]; - INSIST(len > 0 && len <= 32); - i += 2; - INSIST(i + len <= sr.length); - for (j = 0; j < len; j++) { - dns_rdatatype_t t; - if (sr.base[i + j] == 0) - continue; - for (k = 0; k < 8; k++) { - if ((sr.base[i + j] & (0x80 >> k)) == 0) - continue; - t = window * 256 + j * 8 + k; - if (!first) - RETERR(str_totext(" ", target)); - first = ISC_FALSE; - if (dns_rdatatype_isknown(t)) { - RETERR(dns_rdatatype_totext(t, target)); - } else { - sprintf(buf, "TYPE%u", t); - RETERR(str_totext(buf, target)); - } - } - } - } + RETERR(typemap_totext(&sr, tctx, target)); if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) RETERR(str_totext(" )", target)); @@ -240,11 +179,7 @@ totext_nsec3(ARGS_TOTEXT) { static inline isc_result_t fromwire_nsec3(ARGS_FROMWIRE) { isc_region_t sr, rr; - unsigned int window, lastwindow = 0; - unsigned int len; unsigned int saltlen, hashlen; - isc_boolean_t first = ISC_TRUE; - unsigned int i; REQUIRE(type == dns_rdatatype_nsec3); @@ -275,40 +210,8 @@ fromwire_nsec3(ARGS_FROMWIRE) { RETERR(DNS_R_FORMERR); isc_region_consume(&sr, hashlen); - for (i = 0; i < sr.length; i += len) { - /* - * Check for overflow. - */ - if (i + 2 > sr.length) - RETERR(DNS_R_FORMERR); - window = sr.base[i]; - len = sr.base[i + 1]; - i += 2; - /* - * Check that bitmap windows are in the correct order. - */ - if (!first && window <= lastwindow) - RETERR(DNS_R_FORMERR); - /* - * Check for legal lengths. - */ - if (len < 1 || len > 32) - RETERR(DNS_R_FORMERR); - /* - * Check for overflow. - */ - if (i + len > sr.length) - RETERR(DNS_R_FORMERR); - /* - * The last octet of the bitmap must be non zero. - */ - if (sr.base[i + len - 1] == 0) - RETERR(DNS_R_FORMERR); - lastwindow = window; - first = ISC_FALSE; - } - if (i != sr.length) - return (DNS_R_EXTRADATA); + RETERR(typemap_test(&sr, ISC_TRUE)); + RETERR(mem_tobuffer(target, rr.base, rr.length)); isc_buffer_forward(source, rr.length); return (ISC_R_SUCCESS); @@ -346,8 +249,7 @@ compare_nsec3(ARGS_COMPARE) { static inline isc_result_t fromstruct_nsec3(ARGS_FROMSTRUCT) { dns_rdata_nsec3_t *nsec3 = source; - unsigned int i, len, window, lastwindow = 0; - isc_boolean_t first = ISC_TRUE; + isc_region_t region; REQUIRE(type == dns_rdatatype_nsec3); REQUIRE(source != NULL); @@ -367,21 +269,9 @@ fromstruct_nsec3(ARGS_FROMSTRUCT) { RETERR(uint8_tobuffer(nsec3->next_length, target)); RETERR(mem_tobuffer(target, nsec3->next, nsec3->next_length)); - /* - * Perform sanity check. - */ - for (i = 0; i < nsec3->len ; i += len) { - INSIST(i + 2 <= nsec3->len); - window = nsec3->typebits[i]; - len = nsec3->typebits[i+1]; - i += 2; - INSIST(first || window > lastwindow); - INSIST(len > 0 && len <= 32); - INSIST(i + len <= nsec3->len); - INSIST(nsec3->typebits[i + len - 1] != 0); - lastwindow = window; - first = ISC_FALSE; - } + region.base = nsec3->typebits; + region.length = nsec3->len; + RETERR(typemap_test(®ion, ISC_TRUE)); return (mem_tobuffer(target, nsec3->typebits, nsec3->len)); } diff --git a/contrib/bind9/lib/dns/rdata/generic/nsec_47.c b/contrib/bind9/lib/dns/rdata/generic/nsec_47.c index 64bd757fd..3e80612a7 100644 --- a/contrib/bind9/lib/dns/rdata/generic/nsec_47.c +++ b/contrib/bind9/lib/dns/rdata/generic/nsec_47.c @@ -35,10 +35,6 @@ fromtext_nsec(ARGS_FROMTEXT) { isc_token_t token; dns_name_t name; isc_buffer_t buffer; - unsigned char bm[8*1024]; /* 64k bits */ - dns_rdatatype_t covered; - int octet; - int window; REQUIRE(type == dns_rdatatype_nsec); @@ -53,42 +49,17 @@ fromtext_nsec(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); - memset(bm, 0, sizeof(bm)); - do { - RETERR(isc_lex_getmastertoken(lexer, &token, - isc_tokentype_string, ISC_TRUE)); - if (token.type != isc_tokentype_string) - break; - RETTOK(dns_rdatatype_fromtext(&covered, - &token.value.as_textregion)); - bm[covered/8] |= (0x80>>(covered%8)); - } while (1); - isc_lex_ungettoken(lexer, &token); - for (window = 0; window < 256 ; window++) { - /* - * Find if we have a type in this window. - */ - for (octet = 31; octet >= 0; octet--) - if (bm[window * 32 + octet] != 0) - break; - if (octet < 0) - continue; - RETERR(uint8_tobuffer(window, target)); - RETERR(uint8_tobuffer(octet + 1, target)); - RETERR(mem_tobuffer(target, &bm[window * 32], octet + 1)); - } - return (ISC_R_SUCCESS); + return (typemap_fromtext(lexer, target, ISC_FALSE)); } static inline isc_result_t totext_nsec(ARGS_TOTEXT) { isc_region_t sr; - unsigned int i, j, k; dns_name_t name; - unsigned int window, len; REQUIRE(rdata->type == dns_rdatatype_nsec); REQUIRE(rdata->length != 0); @@ -100,45 +71,13 @@ totext_nsec(ARGS_TOTEXT) { dns_name_fromregion(&name, &sr); isc_region_consume(&sr, name_length(&name)); RETERR(dns_name_totext(&name, ISC_FALSE, target)); - - - for (i = 0; i < sr.length; i += len) { - INSIST(i + 2 <= sr.length); - window = sr.base[i]; - len = sr.base[i + 1]; - INSIST(len > 0 && len <= 32); - i += 2; - INSIST(i + len <= sr.length); - for (j = 0; j < len; j++) { - dns_rdatatype_t t; - if (sr.base[i + j] == 0) - continue; - for (k = 0; k < 8; k++) { - if ((sr.base[i + j] & (0x80 >> k)) == 0) - continue; - t = window * 256 + j * 8 + k; - RETERR(str_totext(" ", target)); - if (dns_rdatatype_isknown(t)) { - RETERR(dns_rdatatype_totext(t, target)); - } else { - char buf[sizeof("TYPE65535")]; - sprintf(buf, "TYPE%u", t); - RETERR(str_totext(buf, target)); - } - } - } - } - return (ISC_R_SUCCESS); + return (typemap_totext(&sr, NULL, target)); } static /* inline */ isc_result_t fromwire_nsec(ARGS_FROMWIRE) { isc_region_t sr; dns_name_t name; - unsigned int window, lastwindow = 0; - unsigned int len; - isc_boolean_t first = ISC_TRUE; - unsigned int i; REQUIRE(type == dns_rdatatype_nsec); @@ -151,42 +90,7 @@ fromwire_nsec(ARGS_FROMWIRE) { RETERR(dns_name_fromwire(&name, source, dctx, options, target)); isc_buffer_activeregion(source, &sr); - for (i = 0; i < sr.length; i += len) { - /* - * Check for overflow. - */ - if (i + 2 > sr.length) - RETERR(DNS_R_FORMERR); - window = sr.base[i]; - len = sr.base[i + 1]; - i += 2; - /* - * Check that bitmap windows are in the correct order. - */ - if (!first && window <= lastwindow) - RETERR(DNS_R_FORMERR); - /* - * Check for legal lengths. - */ - if (len < 1 || len > 32) - RETERR(DNS_R_FORMERR); - /* - * Check for overflow. - */ - if (i + len > sr.length) - RETERR(DNS_R_FORMERR); - /* - * The last octet of the bitmap must be non zero. - */ - if (sr.base[i + len - 1] == 0) - RETERR(DNS_R_FORMERR); - lastwindow = window; - first = ISC_FALSE; - } - if (i != sr.length) - return (DNS_R_EXTRADATA); - if (first) - RETERR(DNS_R_FORMERR); + RETERR(typemap_test(&sr, ISC_FALSE)); RETERR(mem_tobuffer(target, sr.base, sr.length)); isc_buffer_forward(source, sr.length); return (ISC_R_SUCCESS); @@ -231,8 +135,6 @@ static inline isc_result_t fromstruct_nsec(ARGS_FROMSTRUCT) { dns_rdata_nsec_t *nsec = source; isc_region_t region; - unsigned int i, len, window, lastwindow = 0; - isc_boolean_t first = ISC_TRUE; REQUIRE(type == dns_rdatatype_nsec); REQUIRE(source != NULL); @@ -245,22 +147,10 @@ fromstruct_nsec(ARGS_FROMSTRUCT) { dns_name_toregion(&nsec->next, ®ion); RETERR(isc_buffer_copyregion(target, ®ion)); - /* - * Perform sanity check. - */ - for (i = 0; i < nsec->len ; i += len) { - INSIST(i + 2 <= nsec->len); - window = nsec->typebits[i]; - len = nsec->typebits[i+1]; - i += 2; - INSIST(first || window > lastwindow); - INSIST(len > 0 && len <= 32); - INSIST(i + len <= nsec->len); - INSIST(nsec->typebits[i + len - 1] != 0); - lastwindow = window; - first = ISC_FALSE; - } - INSIST(!first); + + region.base = nsec->typebits; + region.length = nsec->len; + RETERR(typemap_test(®ion, ISC_FALSE)); return (mem_tobuffer(target, nsec->typebits, nsec->len)); } diff --git a/contrib/bind9/lib/dns/rdata/generic/nxt_30.c b/contrib/bind9/lib/dns/rdata/generic/nxt_30.c index fbb34e981..b65461157 100644 --- a/contrib/bind9/lib/dns/rdata/generic/nxt_30.c +++ b/contrib/bind9/lib/dns/rdata/generic/nxt_30.c @@ -55,7 +55,8 @@ fromtext_nxt(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); memset(bm, 0, sizeof(bm)); diff --git a/contrib/bind9/lib/dns/rdata/generic/ptr_12.c b/contrib/bind9/lib/dns/rdata/generic/ptr_12.c index e3f65cf28..b81bf1f2a 100644 --- a/contrib/bind9/lib/dns/rdata/generic/ptr_12.c +++ b/contrib/bind9/lib/dns/rdata/generic/ptr_12.c @@ -41,7 +41,8 @@ fromtext_ptr(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); if (rdclass == dns_rdataclass_in && (options & DNS_RDATA_CHECKNAMES) != 0 && diff --git a/contrib/bind9/lib/dns/rdata/generic/rkey_57.c b/contrib/bind9/lib/dns/rdata/generic/rkey_57.c new file mode 100644 index 000000000..a57d1bc13 --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/rkey_57.c @@ -0,0 +1,173 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef RDATA_GENERIC_RKEY_57_C +#define RDATA_GENERIC_RKEY_57_C + +#define RRTYPE_RKEY_ATTRIBUTES 0 + +static inline isc_result_t +fromtext_rkey(ARGS_FROMTEXT) { + + REQUIRE(type == dns_rdatatype_rkey); + + return (generic_fromtext_key(rdclass, type, lexer, origin, + options, target, callbacks)); +} + +static inline isc_result_t +totext_rkey(ARGS_TOTEXT) { + + REQUIRE(rdata != NULL); + REQUIRE(rdata->type == dns_rdatatype_rkey); + + return (generic_totext_key(rdata, tctx, target)); +} + +static inline isc_result_t +fromwire_rkey(ARGS_FROMWIRE) { + + REQUIRE(type == dns_rdatatype_rkey); + + return (generic_fromwire_key(rdclass, type, source, dctx, + options, target)); +} + +static inline isc_result_t +towire_rkey(ARGS_TOWIRE) { + isc_region_t sr; + + REQUIRE(rdata != NULL); + REQUIRE(rdata->type == dns_rdatatype_rkey); + REQUIRE(rdata->length != 0); + + UNUSED(cctx); + + dns_rdata_toregion(rdata, &sr); + return (mem_tobuffer(target, sr.base, sr.length)); +} + +static inline int +compare_rkey(ARGS_COMPARE) { + isc_region_t r1; + isc_region_t r2; + + REQUIRE(rdata1 != NULL); + REQUIRE(rdata2 != NULL); + REQUIRE(rdata1->type == rdata2->type); + REQUIRE(rdata1->rdclass == rdata2->rdclass); + REQUIRE(rdata1->type == dns_rdatatype_rkey); + REQUIRE(rdata1->length != 0); + REQUIRE(rdata2->length != 0); + + dns_rdata_toregion(rdata1, &r1); + dns_rdata_toregion(rdata2, &r2); + return (isc_region_compare(&r1, &r2)); +} + +static inline isc_result_t +fromstruct_rkey(ARGS_FROMSTRUCT) { + + REQUIRE(type == dns_rdatatype_rkey); + + return (generic_fromstruct_key(rdclass, type, source, target)); +} + +static inline isc_result_t +tostruct_rkey(ARGS_TOSTRUCT) { + dns_rdata_rkey_t *rkey = target; + + REQUIRE(rkey != NULL); + REQUIRE(rdata != NULL); + REQUIRE(rdata->type == dns_rdatatype_rkey); + + rkey->common.rdclass = rdata->rdclass; + rkey->common.rdtype = rdata->type; + ISC_LINK_INIT(&rkey->common, link); + + return (generic_tostruct_key(rdata, target, mctx)); +} + +static inline void +freestruct_rkey(ARGS_FREESTRUCT) { + dns_rdata_rkey_t *rkey = (dns_rdata_rkey_t *) source; + + REQUIRE(rkey != NULL); + REQUIRE(rkey->common.rdtype == dns_rdatatype_rkey); + + generic_freestruct_key(source); +} + +static inline isc_result_t +additionaldata_rkey(ARGS_ADDLDATA) { + + REQUIRE(rdata->type == dns_rdatatype_rkey); + + UNUSED(rdata); + UNUSED(add); + UNUSED(arg); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +digest_rkey(ARGS_DIGEST) { + isc_region_t r; + + REQUIRE(rdata != NULL); + REQUIRE(rdata->type == dns_rdatatype_rkey); + + dns_rdata_toregion(rdata, &r); + + return ((digest)(arg, &r)); +} + +static inline isc_boolean_t +checkowner_rkey(ARGS_CHECKOWNER) { + + REQUIRE(type == dns_rdatatype_rkey); + + UNUSED(name); + UNUSED(type); + UNUSED(rdclass); + UNUSED(wildcard); + + return (ISC_TRUE); +} + +static inline isc_boolean_t +checknames_rkey(ARGS_CHECKNAMES) { + + REQUIRE(rdata != NULL); + REQUIRE(rdata->type == dns_rdatatype_rkey); + + UNUSED(rdata); + UNUSED(owner); + UNUSED(bad); + + return (ISC_TRUE); +} + +static inline int +casecompare_rkey(ARGS_COMPARE) { + + /* + * Treat ALG 253 (private DNS) subtype name case sensistively. + */ + return (compare_rkey(rdata1, rdata2)); +} + +#endif /* RDATA_GENERIC_RKEY_57_C */ diff --git a/contrib/bind9/lib/dns/rdata/generic/rkey_57.h b/contrib/bind9/lib/dns/rdata/generic/rkey_57.h new file mode 100644 index 000000000..330b3fbad --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/rkey_57.h @@ -0,0 +1,22 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_RKEY_57_H +#define GENERIC_RKEY_57_H 1 + +typedef struct dns_rdata_key dns_rdata_rkey_t; + +#endif /* GENERIC_RKEY_57_H */ diff --git a/contrib/bind9/lib/dns/rdata/generic/rp_17.c b/contrib/bind9/lib/dns/rdata/generic/rp_17.c index e67c25ec7..440a75a14 100644 --- a/contrib/bind9/lib/dns/rdata/generic/rp_17.c +++ b/contrib/bind9/lib/dns/rdata/generic/rp_17.c @@ -38,7 +38,8 @@ fromtext_rp(ARGS_FROMTEXT) { UNUSED(rdclass); UNUSED(callbacks); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; for (i = 0; i < 2; i++) { RETERR(isc_lex_getmastertoken(lexer, &token, diff --git a/contrib/bind9/lib/dns/rdata/generic/rrsig_46.c b/contrib/bind9/lib/dns/rdata/generic/rrsig_46.c index 8ae9319c5..43ca2d3a5 100644 --- a/contrib/bind9/lib/dns/rdata/generic/rrsig_46.c +++ b/contrib/bind9/lib/dns/rdata/generic/rrsig_46.c @@ -141,7 +141,8 @@ fromtext_rrsig(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); /* diff --git a/contrib/bind9/lib/dns/rdata/generic/rt_21.c b/contrib/bind9/lib/dns/rdata/generic/rt_21.c index a9a89b268..ce6e99a0b 100644 --- a/contrib/bind9/lib/dns/rdata/generic/rt_21.c +++ b/contrib/bind9/lib/dns/rdata/generic/rt_21.c @@ -50,7 +50,8 @@ fromtext_rt(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); ok = ISC_TRUE; if ((options & DNS_RDATA_CHECKNAMES) != 0) diff --git a/contrib/bind9/lib/dns/rdata/generic/sig_24.c b/contrib/bind9/lib/dns/rdata/generic/sig_24.c index af9c7daaa..0dff80af6 100644 --- a/contrib/bind9/lib/dns/rdata/generic/sig_24.c +++ b/contrib/bind9/lib/dns/rdata/generic/sig_24.c @@ -115,7 +115,8 @@ fromtext_sig(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); /* diff --git a/contrib/bind9/lib/dns/rdata/generic/sink_40.c b/contrib/bind9/lib/dns/rdata/generic/sink_40.c new file mode 100644 index 000000000..dafa94beb --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/sink_40.c @@ -0,0 +1,283 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef RDATA_GENERIC_SINK_40_C +#define RDATA_GENERIC_SINK_40_C + +#include + +#define RRTYPE_SINK_ATTRIBUTES (0) + +static inline isc_result_t +fromtext_sink(ARGS_FROMTEXT) { + isc_token_t token; + + REQUIRE(type == dns_rdatatype_sink); + + UNUSED(type); + UNUSED(rdclass); + UNUSED(origin); + UNUSED(options); + UNUSED(callbacks); + + /* meaning */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, + ISC_FALSE)); + if (token.value.as_ulong > 0xffU) + RETTOK(ISC_R_RANGE); + RETERR(uint8_tobuffer(token.value.as_ulong, target)); + + /* coding */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, + ISC_FALSE)); + if (token.value.as_ulong > 0xffU) + RETTOK(ISC_R_RANGE); + RETERR(uint8_tobuffer(token.value.as_ulong, target)); + + /* subcoding */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number, + ISC_FALSE)); + if (token.value.as_ulong > 0xffU) + RETTOK(ISC_R_RANGE); + RETERR(uint8_tobuffer(token.value.as_ulong, target)); + + return(isc_base64_tobuffer(lexer, target, -1)); +} + +static inline isc_result_t +totext_sink(ARGS_TOTEXT) { + isc_region_t sr; + char buf[sizeof("255 255 255")]; + isc_uint8_t meaning, coding, subcoding; + + REQUIRE(rdata->type == dns_rdatatype_sink); + REQUIRE(rdata->length >= 3); + + dns_rdata_toregion(rdata, &sr); + + /* Meaning, Coding and Subcoding */ + meaning = uint8_fromregion(&sr); + isc_region_consume(&sr, 1); + coding = uint8_fromregion(&sr); + isc_region_consume(&sr, 1); + subcoding = uint8_fromregion(&sr); + isc_region_consume(&sr, 1); + sprintf(buf, "%u %u %u", meaning, coding, subcoding); + RETERR(str_totext(buf, target)); + + if (sr.length == 0U) + return (ISC_R_SUCCESS); + + /* data */ + if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) + RETERR(str_totext(" (", target)); + + RETERR(str_totext(tctx->linebreak, target)); + + if (tctx->width == 0) /* No splitting */ + RETERR(isc_base64_totext(&sr, 60, "", target)); + else + RETERR(isc_base64_totext(&sr, tctx->width - 2, + tctx->linebreak, target)); + + if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) + RETERR(str_totext(" )", target)); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +fromwire_sink(ARGS_FROMWIRE) { + isc_region_t sr; + + REQUIRE(type == dns_rdatatype_sink); + + UNUSED(type); + UNUSED(rdclass); + UNUSED(dctx); + UNUSED(options); + + isc_buffer_activeregion(source, &sr); + if (sr.length < 3) + return (ISC_R_UNEXPECTEDEND); + + RETERR(mem_tobuffer(target, sr.base, sr.length)); + isc_buffer_forward(source, sr.length); + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +towire_sink(ARGS_TOWIRE) { + + REQUIRE(rdata->type == dns_rdatatype_sink); + REQUIRE(rdata->length >= 3); + + UNUSED(cctx); + + return (mem_tobuffer(target, rdata->data, rdata->length)); +} + +static inline int +compare_sink(ARGS_COMPARE) { + isc_region_t r1; + isc_region_t r2; + + REQUIRE(rdata1->type == rdata2->type); + REQUIRE(rdata1->rdclass == rdata2->rdclass); + REQUIRE(rdata1->type == dns_rdatatype_sink); + REQUIRE(rdata1->length >= 3); + REQUIRE(rdata2->length >= 3); + + dns_rdata_toregion(rdata1, &r1); + dns_rdata_toregion(rdata2, &r2); + return (isc_region_compare(&r1, &r2)); +} + +static inline isc_result_t +fromstruct_sink(ARGS_FROMSTRUCT) { + dns_rdata_sink_t *sink = source; + + REQUIRE(type == dns_rdatatype_sink); + REQUIRE(source != NULL); + REQUIRE(sink->common.rdtype == type); + REQUIRE(sink->common.rdclass == rdclass); + + UNUSED(type); + UNUSED(rdclass); + + /* Meaning */ + RETERR(uint8_tobuffer(sink->meaning, target)); + + /* Coding */ + RETERR(uint8_tobuffer(sink->coding, target)); + + /* Subcoding */ + RETERR(uint8_tobuffer(sink->subcoding, target)); + + /* Data */ + return (mem_tobuffer(target, sink->data, sink->datalen)); +} + +static inline isc_result_t +tostruct_sink(ARGS_TOSTRUCT) { + dns_rdata_sink_t *sink = target; + isc_region_t sr; + + REQUIRE(rdata->type == dns_rdatatype_sink); + REQUIRE(target != NULL); + REQUIRE(rdata->length >= 3); + + sink->common.rdclass = rdata->rdclass; + sink->common.rdtype = rdata->type; + ISC_LINK_INIT(&sink->common, link); + + dns_rdata_toregion(rdata, &sr); + + /* Meaning */ + if (sr.length < 1) + return (ISC_R_UNEXPECTEDEND); + sink->meaning = uint8_fromregion(&sr); + isc_region_consume(&sr, 1); + + /* Coding */ + if (sr.length < 1) + return (ISC_R_UNEXPECTEDEND); + sink->coding = uint8_fromregion(&sr); + isc_region_consume(&sr, 1); + + /* Subcoding */ + if (sr.length < 1) + return (ISC_R_UNEXPECTEDEND); + sink->subcoding = uint8_fromregion(&sr); + isc_region_consume(&sr, 1); + + /* Data */ + sink->datalen = sr.length; + sink->data = mem_maybedup(mctx, sr.base, sink->datalen); + if (sink->data == NULL) + return (ISC_R_NOMEMORY); + + sink->mctx = mctx; + return (ISC_R_SUCCESS); +} + +static inline void +freestruct_sink(ARGS_FREESTRUCT) { + dns_rdata_sink_t *sink = (dns_rdata_sink_t *) source; + + REQUIRE(source != NULL); + REQUIRE(sink->common.rdtype == dns_rdatatype_sink); + + if (sink->mctx == NULL) + return; + + if (sink->data != NULL) + isc_mem_free(sink->mctx, sink->data); + sink->mctx = NULL; +} + +static inline isc_result_t +additionaldata_sink(ARGS_ADDLDATA) { + REQUIRE(rdata->type == dns_rdatatype_sink); + + UNUSED(rdata); + UNUSED(add); + UNUSED(arg); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +digest_sink(ARGS_DIGEST) { + isc_region_t r; + + REQUIRE(rdata->type == dns_rdatatype_sink); + + dns_rdata_toregion(rdata, &r); + + return ((digest)(arg, &r)); +} + +static inline isc_boolean_t +checkowner_sink(ARGS_CHECKOWNER) { + + REQUIRE(type == dns_rdatatype_sink); + + UNUSED(name); + UNUSED(type); + UNUSED(rdclass); + UNUSED(wildcard); + + return (ISC_TRUE); +} + +static inline isc_boolean_t +checknames_sink(ARGS_CHECKNAMES) { + + REQUIRE(rdata->type == dns_rdatatype_sink); + + UNUSED(rdata); + UNUSED(owner); + UNUSED(bad); + + return (ISC_TRUE); +} + +static inline int +casecompare_sink(ARGS_COMPARE) { + return (compare_sink(rdata1, rdata2)); +} +#endif /* RDATA_GENERIC_SINK_40_C */ diff --git a/contrib/bind9/lib/dns/rdata/generic/sink_40.h b/contrib/bind9/lib/dns/rdata/generic/sink_40.h new file mode 100644 index 000000000..e6a2400c4 --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/sink_40.h @@ -0,0 +1,30 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_SINK_40_H +#define GENERIC_SINK_40_H 1 + +typedef struct dns_rdata_sink_t { + dns_rdatacommon_t common; + isc_mem_t * mctx; + isc_uint8_t meaning; + isc_uint8_t coding; + isc_uint8_t subcoding; + isc_uint16_t datalen; + unsigned char * data; +} dns_rdata_sink_t; + +#endif /* GENERIC_SINK_40_H */ diff --git a/contrib/bind9/lib/dns/rdata/generic/smimea_53.c b/contrib/bind9/lib/dns/rdata/generic/smimea_53.c new file mode 100644 index 000000000..e46655b6c --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/smimea_53.c @@ -0,0 +1,161 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef RDATA_GENERIC_SMIMEA_53_C +#define RDATA_GENERIC_SMIMEA_53_C + +#define RRTYPE_SMIMEA_ATTRIBUTES 0 + +static inline isc_result_t +fromtext_smimea(ARGS_FROMTEXT) { + + REQUIRE(type == dns_rdatatype_smimea); + + return (generic_fromtext_tlsa(rdclass, type, lexer, origin, options, + target, callbacks)); +} + +static inline isc_result_t +totext_smimea(ARGS_TOTEXT) { + + REQUIRE(rdata->type == dns_rdatatype_smimea); + + return (generic_totext_tlsa(rdata, tctx, target)); +} + +static inline isc_result_t +fromwire_smimea(ARGS_FROMWIRE) { + + REQUIRE(type == dns_rdatatype_smimea); + + return (generic_fromwire_tlsa(rdclass, type, source, dctx, options, + target)); +} + +static inline isc_result_t +towire_smimea(ARGS_TOWIRE) { + isc_region_t sr; + + REQUIRE(rdata->type == dns_rdatatype_smimea); + REQUIRE(rdata->length != 0); + + UNUSED(cctx); + + dns_rdata_toregion(rdata, &sr); + return (mem_tobuffer(target, sr.base, sr.length)); +} + +static inline int +compare_smimea(ARGS_COMPARE) { + isc_region_t r1; + isc_region_t r2; + + REQUIRE(rdata1->type == rdata2->type); + REQUIRE(rdata1->rdclass == rdata2->rdclass); + REQUIRE(rdata1->type == dns_rdatatype_smimea); + REQUIRE(rdata1->length != 0); + REQUIRE(rdata2->length != 0); + + dns_rdata_toregion(rdata1, &r1); + dns_rdata_toregion(rdata2, &r2); + return (isc_region_compare(&r1, &r2)); +} + +static inline isc_result_t +fromstruct_smimea(ARGS_FROMSTRUCT) { + + REQUIRE(type == dns_rdatatype_smimea); + + return (generic_fromstruct_tlsa(rdclass, type, source, target)); +} + +static inline isc_result_t +tostruct_smimea(ARGS_TOSTRUCT) { + dns_rdata_txt_t *txt = target; + + REQUIRE(rdata->type == dns_rdatatype_smimea); + REQUIRE(target != NULL); + + txt->common.rdclass = rdata->rdclass; + txt->common.rdtype = rdata->type; + ISC_LINK_INIT(&txt->common, link); + + return (generic_tostruct_tlsa(rdata, target, mctx)); +} + +static inline void +freestruct_smimea(ARGS_FREESTRUCT) { + dns_rdata_txt_t *txt = source; + + REQUIRE(source != NULL); + REQUIRE(txt->common.rdtype == dns_rdatatype_smimea); + + generic_freestruct_tlsa(source); +} + +static inline isc_result_t +additionaldata_smimea(ARGS_ADDLDATA) { + REQUIRE(rdata->type == dns_rdatatype_smimea); + + UNUSED(rdata); + UNUSED(add); + UNUSED(arg); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +digest_smimea(ARGS_DIGEST) { + isc_region_t r; + + REQUIRE(rdata->type == dns_rdatatype_smimea); + + dns_rdata_toregion(rdata, &r); + + return ((digest)(arg, &r)); +} + +static inline isc_boolean_t +checkowner_smimea(ARGS_CHECKOWNER) { + + REQUIRE(type == dns_rdatatype_smimea); + + UNUSED(name); + UNUSED(type); + UNUSED(rdclass); + UNUSED(wildcard); + + return (ISC_TRUE); +} + +static inline isc_boolean_t +checknames_smimea(ARGS_CHECKNAMES) { + + REQUIRE(rdata->type == dns_rdatatype_smimea); + + UNUSED(rdata); + UNUSED(owner); + UNUSED(bad); + + return (ISC_TRUE); +} + +static inline int +casecompare_smimea(ARGS_COMPARE) { + return (compare_smimea(rdata1, rdata2)); +} + +#endif /* RDATA_GENERIC_SMIMEA_53_C */ diff --git a/contrib/bind9/lib/dns/rdata/generic/smimea_53.h b/contrib/bind9/lib/dns/rdata/generic/smimea_53.h new file mode 100644 index 000000000..9adc988a1 --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/smimea_53.h @@ -0,0 +1,22 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_SMIMEA_53_H +#define GENERIC_SMIMEA_53_H 1 + +typedef struct dns_rdata_tlsa dns_rdata_smimea_t; + +#endif /* GENERIC_SMIMEA_53_H */ diff --git a/contrib/bind9/lib/dns/rdata/generic/soa_6.c b/contrib/bind9/lib/dns/rdata/generic/soa_6.c index b40781381..ec26a3d5f 100644 --- a/contrib/bind9/lib/dns/rdata/generic/soa_6.c +++ b/contrib/bind9/lib/dns/rdata/generic/soa_6.c @@ -39,7 +39,8 @@ fromtext_soa(ARGS_FROMTEXT) { UNUSED(rdclass); UNUSED(callbacks); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; for (i = 0; i < 2; i++) { RETERR(isc_lex_getmastertoken(lexer, &token, diff --git a/contrib/bind9/lib/dns/rdata/generic/spf_99.c b/contrib/bind9/lib/dns/rdata/generic/spf_99.c index 8ad4f02b9..2fa1174d4 100644 --- a/contrib/bind9/lib/dns/rdata/generic/spf_99.c +++ b/contrib/bind9/lib/dns/rdata/generic/spf_99.c @@ -26,8 +26,6 @@ static inline isc_result_t fromtext_spf(ARGS_FROMTEXT) { - isc_token_t token; - int strings; REQUIRE(type == dns_rdatatype_spf); @@ -37,44 +35,22 @@ fromtext_spf(ARGS_FROMTEXT) { UNUSED(options); UNUSED(callbacks); - strings = 0; - for (;;) { - RETERR(isc_lex_getmastertoken(lexer, &token, - isc_tokentype_qstring, - ISC_TRUE)); - if (token.type != isc_tokentype_qstring && - token.type != isc_tokentype_string) - break; - RETTOK(txt_fromtext(&token.value.as_textregion, target)); - strings++; - } - /* Let upper layer handle eol/eof. */ - isc_lex_ungettoken(lexer, &token); - return (strings == 0 ? ISC_R_UNEXPECTEDEND : ISC_R_SUCCESS); + return (generic_fromtext_txt(rdclass, type, lexer, origin, options, + target, callbacks)); } static inline isc_result_t totext_spf(ARGS_TOTEXT) { - isc_region_t region; UNUSED(tctx); REQUIRE(rdata->type == dns_rdatatype_spf); - dns_rdata_toregion(rdata, ®ion); - - while (region.length > 0) { - RETERR(txt_totext(®ion, ISC_TRUE, target)); - if (region.length > 0) - RETERR(str_totext(" ", target)); - } - - return (ISC_R_SUCCESS); + return (generic_totext_txt(rdata, tctx, target)); } static inline isc_result_t fromwire_spf(ARGS_FROMWIRE) { - isc_result_t result; REQUIRE(type == dns_rdatatype_spf); @@ -83,29 +59,18 @@ fromwire_spf(ARGS_FROMWIRE) { UNUSED(rdclass); UNUSED(options); - do { - result = txt_fromwire(source, target); - if (result != ISC_R_SUCCESS) - return (result); - } while (!buffer_empty(source)); - return (ISC_R_SUCCESS); + return (generic_fromwire_txt(rdclass, type, source, dctx, options, + target)); } static inline isc_result_t towire_spf(ARGS_TOWIRE) { - isc_region_t region; REQUIRE(rdata->type == dns_rdatatype_spf); UNUSED(cctx); - isc_buffer_availableregion(target, ®ion); - if (region.length < rdata->length) - return (ISC_R_NOSPACE); - - memmove(region.base, rdata->data, rdata->length); - isc_buffer_add(target, rdata->length); - return (ISC_R_SUCCESS); + return (mem_tobuffer(target, rdata->data, rdata->length)); } static inline int @@ -124,53 +89,24 @@ compare_spf(ARGS_COMPARE) { static inline isc_result_t fromstruct_spf(ARGS_FROMSTRUCT) { - dns_rdata_spf_t *txt = source; - isc_region_t region; - isc_uint8_t length; REQUIRE(type == dns_rdatatype_spf); - REQUIRE(source != NULL); - REQUIRE(txt->common.rdtype == type); - REQUIRE(txt->common.rdclass == rdclass); - REQUIRE(txt->txt != NULL && txt->txt_len != 0); - UNUSED(type); - UNUSED(rdclass); - - region.base = txt->txt; - region.length = txt->txt_len; - while (region.length > 0) { - length = uint8_fromregion(®ion); - isc_region_consume(®ion, 1); - if (region.length <= length) - return (ISC_R_UNEXPECTEDEND); - isc_region_consume(®ion, length); - } - - return (mem_tobuffer(target, txt->txt, txt->txt_len)); + return (generic_fromstruct_txt(rdclass, type, source, target)); } static inline isc_result_t tostruct_spf(ARGS_TOSTRUCT) { - dns_rdata_spf_t *txt = target; - isc_region_t r; + dns_rdata_spf_t *spf = target; REQUIRE(rdata->type == dns_rdatatype_spf); REQUIRE(target != NULL); - txt->common.rdclass = rdata->rdclass; - txt->common.rdtype = rdata->type; - ISC_LINK_INIT(&txt->common, link); + spf->common.rdclass = rdata->rdclass; + spf->common.rdtype = rdata->type; + ISC_LINK_INIT(&spf->common, link); - dns_rdata_toregion(rdata, &r); - txt->txt_len = r.length; - txt->txt = mem_maybedup(mctx, r.base, r.length); - if (txt->txt == NULL) - return (ISC_R_NOMEMORY); - - txt->offset = 0; - txt->mctx = mctx; - return (ISC_R_SUCCESS); + return (generic_tostruct_txt(rdata, target, mctx)); } static inline void @@ -180,12 +116,7 @@ freestruct_spf(ARGS_FREESTRUCT) { REQUIRE(source != NULL); REQUIRE(txt->common.rdtype == dns_rdatatype_spf); - if (txt->mctx == NULL) - return; - - if (txt->txt != NULL) - isc_mem_free(txt->mctx, txt->txt); - txt->mctx = NULL; + generic_freestruct_txt(source); } static inline isc_result_t diff --git a/contrib/bind9/lib/dns/rdata/generic/ta_32768.c b/contrib/bind9/lib/dns/rdata/generic/ta_32768.c new file mode 100644 index 000000000..d802211f3 --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/ta_32768.c @@ -0,0 +1,170 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* http://www.watson.org/~weiler/INI1999-19.pdf */ + +#ifndef RDATA_GENERIC_TA_32768_C +#define RDATA_GENERIC_TA_32768_C + +#define RRTYPE_TA_ATTRIBUTES 0 + +static inline isc_result_t +fromtext_ta(ARGS_FROMTEXT) { + + REQUIRE(type == dns_rdatatype_ta); + + return (generic_fromtext_ds(rdclass, type, lexer, origin, options, + target, callbacks)); +} + +static inline isc_result_t +totext_ta(ARGS_TOTEXT) { + + REQUIRE(rdata->type == dns_rdatatype_ta); + + return (generic_totext_ds(rdata, tctx, target)); +} + +static inline isc_result_t +fromwire_ta(ARGS_FROMWIRE) { + + REQUIRE(type == dns_rdatatype_ta); + + return (generic_fromwire_ds(rdclass, type, source, dctx, options, + target)); +} + +static inline isc_result_t +towire_ta(ARGS_TOWIRE) { + isc_region_t sr; + + REQUIRE(rdata->type == dns_rdatatype_ta); + REQUIRE(rdata->length != 0); + + UNUSED(cctx); + + dns_rdata_toregion(rdata, &sr); + return (mem_tobuffer(target, sr.base, sr.length)); +} + +static inline int +compare_ta(ARGS_COMPARE) { + isc_region_t r1; + isc_region_t r2; + + REQUIRE(rdata1->type == rdata2->type); + REQUIRE(rdata1->rdclass == rdata2->rdclass); + REQUIRE(rdata1->type == dns_rdatatype_ta); + REQUIRE(rdata1->length != 0); + REQUIRE(rdata2->length != 0); + + dns_rdata_toregion(rdata1, &r1); + dns_rdata_toregion(rdata2, &r2); + return (isc_region_compare(&r1, &r2)); +} + +static inline isc_result_t +fromstruct_ta(ARGS_FROMSTRUCT) { + + REQUIRE(type == dns_rdatatype_ta); + + return (generic_fromstruct_ds(rdclass, type, source, target)); +} + +static inline isc_result_t +tostruct_ta(ARGS_TOSTRUCT) { + dns_rdata_ds_t *ds = target; + + REQUIRE(rdata->type == dns_rdatatype_ta); + + /* + * Checked by generic_tostruct_ds(). + */ + ds->common.rdclass = rdata->rdclass; + ds->common.rdtype = rdata->type; + ISC_LINK_INIT(&ds->common, link); + + return (generic_tostruct_ds(rdata, target, mctx)); +} + +static inline void +freestruct_ta(ARGS_FREESTRUCT) { + dns_rdata_ta_t *ds = source; + + REQUIRE(ds != NULL); + REQUIRE(ds->common.rdtype == dns_rdatatype_ta); + + if (ds->mctx == NULL) + return; + + if (ds->digest != NULL) + isc_mem_free(ds->mctx, ds->digest); + ds->mctx = NULL; +} + +static inline isc_result_t +additionaldata_ta(ARGS_ADDLDATA) { + REQUIRE(rdata->type == dns_rdatatype_ta); + + UNUSED(rdata); + UNUSED(add); + UNUSED(arg); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +digest_ta(ARGS_DIGEST) { + isc_region_t r; + + REQUIRE(rdata->type == dns_rdatatype_ta); + + dns_rdata_toregion(rdata, &r); + + return ((digest)(arg, &r)); +} + +static inline isc_boolean_t +checkowner_ta(ARGS_CHECKOWNER) { + + REQUIRE(type == dns_rdatatype_ta); + + UNUSED(name); + UNUSED(type); + UNUSED(rdclass); + UNUSED(wildcard); + + return (ISC_TRUE); +} + +static inline isc_boolean_t +checknames_ta(ARGS_CHECKNAMES) { + + REQUIRE(rdata->type == dns_rdatatype_ta); + + UNUSED(rdata); + UNUSED(owner); + UNUSED(bad); + + return (ISC_TRUE); +} + +static inline int +casecompare_ta(ARGS_COMPARE) { + return (compare_ta(rdata1, rdata2)); +} + +#endif /* RDATA_GENERIC_TA_32768_C */ diff --git a/contrib/bind9/lib/dns/rdata/generic/ta_32768.h b/contrib/bind9/lib/dns/rdata/generic/ta_32768.h new file mode 100644 index 000000000..3e50ed05c --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/ta_32768.h @@ -0,0 +1,25 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_TA_32768_H +#define GENERIC_TA_32768_H 1 + +/* + * TA records are identical to DS records. + */ +typedef struct dns_rdata_ds dns_rdata_ta_t; + +#endif /* GENERIC_TA_32768_H */ diff --git a/contrib/bind9/lib/dns/rdata/generic/talink_58.c b/contrib/bind9/lib/dns/rdata/generic/talink_58.c new file mode 100644 index 000000000..db4662469 --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/talink_58.c @@ -0,0 +1,269 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef RDATA_GENERIC_TALINK_58_C +#define RDATA_GENERIC_TALINK_58_C + +#define RRTYPE_TALINK_ATTRIBUTES 0 + +static inline isc_result_t +fromtext_talink(ARGS_FROMTEXT) { + isc_token_t token; + dns_name_t name; + isc_buffer_t buffer; + int i; + + REQUIRE(type == dns_rdatatype_talink); + + UNUSED(type); + UNUSED(rdclass); + UNUSED(callbacks); + + if (origin == NULL) + origin = dns_rootname; + + for (i = 0; i < 2; i++) { + RETERR(isc_lex_getmastertoken(lexer, &token, + isc_tokentype_string, + ISC_FALSE)); + + dns_name_init(&name, NULL); + buffer_fromregion(&buffer, &token.value.as_region); + RETTOK(dns_name_fromtext(&name, &buffer, origin, + options, target)); + } + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +totext_talink(ARGS_TOTEXT) { + isc_region_t dregion; + dns_name_t prev; + dns_name_t next; + dns_name_t prefix; + isc_boolean_t sub; + + REQUIRE(rdata->type == dns_rdatatype_talink); + REQUIRE(rdata->length != 0); + + dns_name_init(&prev, NULL); + dns_name_init(&next, NULL); + dns_name_init(&prefix, NULL); + + dns_rdata_toregion(rdata, &dregion); + + dns_name_fromregion(&prev, &dregion); + isc_region_consume(&dregion, name_length(&prev)); + + dns_name_fromregion(&next, &dregion); + isc_region_consume(&dregion, name_length(&next)); + + sub = name_prefix(&prev, tctx->origin, &prefix); + RETERR(dns_name_totext(&prefix, sub, target)); + + RETERR(str_totext(" ", target)); + + sub = name_prefix(&next, tctx->origin, &prefix); + return(dns_name_totext(&prefix, sub, target)); +} + +static inline isc_result_t +fromwire_talink(ARGS_FROMWIRE) { + dns_name_t prev; + dns_name_t next; + + REQUIRE(type == dns_rdatatype_talink); + + UNUSED(type); + UNUSED(rdclass); + + dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE); + + dns_name_init(&prev, NULL); + dns_name_init(&next, NULL); + + RETERR(dns_name_fromwire(&prev, source, dctx, options, target)); + return(dns_name_fromwire(&next, source, dctx, options, target)); +} + +static inline isc_result_t +towire_talink(ARGS_TOWIRE) { + isc_region_t sregion; + dns_name_t prev; + dns_name_t next; + dns_offsets_t moffsets; + dns_offsets_t roffsets; + + REQUIRE(rdata->type == dns_rdatatype_talink); + REQUIRE(rdata->length != 0); + + dns_compress_setmethods(cctx, DNS_COMPRESS_NONE); + + dns_name_init(&prev, moffsets); + dns_name_init(&next, roffsets); + + dns_rdata_toregion(rdata, &sregion); + + dns_name_fromregion(&prev, &sregion); + isc_region_consume(&sregion, name_length(&prev)); + RETERR(dns_name_towire(&prev, cctx, target)); + + dns_name_fromregion(&next, &sregion); + isc_region_consume(&sregion, name_length(&next)); + return(dns_name_towire(&next, cctx, target)); +} + +static inline int +compare_talink(ARGS_COMPARE) { + isc_region_t region1; + isc_region_t region2; + + REQUIRE(rdata1->type == rdata2->type); + REQUIRE(rdata1->rdclass == rdata2->rdclass); + REQUIRE(rdata1->type == dns_rdatatype_talink); + REQUIRE(rdata1->length != 0); + REQUIRE(rdata2->length != 0); + + dns_rdata_toregion(rdata1, ®ion1); + dns_rdata_toregion(rdata2, ®ion2); + return (isc_region_compare(®ion1, ®ion2)); +} + +static inline isc_result_t +fromstruct_talink(ARGS_FROMSTRUCT) { + dns_rdata_talink_t *talink = source; + isc_region_t region; + + REQUIRE(type == dns_rdatatype_talink); + REQUIRE(source != NULL); + REQUIRE(talink->common.rdtype == type); + REQUIRE(talink->common.rdclass == rdclass); + + UNUSED(type); + UNUSED(rdclass); + + dns_name_toregion(&talink->prev, ®ion); + RETERR(isc_buffer_copyregion(target, ®ion)); + dns_name_toregion(&talink->next, ®ion); + return(isc_buffer_copyregion(target, ®ion)); +} + +static inline isc_result_t +tostruct_talink(ARGS_TOSTRUCT) { + isc_region_t region; + dns_rdata_talink_t *talink = target; + dns_name_t name; + isc_result_t result; + + REQUIRE(rdata->type == dns_rdatatype_talink); + REQUIRE(target != NULL); + REQUIRE(rdata->length != 0); + + talink->common.rdclass = rdata->rdclass; + talink->common.rdtype = rdata->type; + ISC_LINK_INIT(&talink->common, link); + + dns_rdata_toregion(rdata, ®ion); + + dns_name_init(&name, NULL); + dns_name_fromregion(&name, ®ion); + isc_region_consume(®ion, name_length(&name)); + dns_name_init(&talink->prev, NULL); + RETERR(name_duporclone(&name, mctx, &talink->prev)); + + dns_name_fromregion(&name, ®ion); + isc_region_consume(®ion, name_length(&name)); + dns_name_init(&talink->next, NULL); + result = name_duporclone(&name, mctx, &talink->next); + if (result != ISC_R_SUCCESS) + goto cleanup; + + talink->mctx = mctx; + return (ISC_R_SUCCESS); + + cleanup: + if (mctx != NULL) + dns_name_free(&talink->prev, mctx); + return (ISC_R_NOMEMORY); +} + +static inline void +freestruct_talink(ARGS_FREESTRUCT) { + dns_rdata_talink_t *talink = source; + + REQUIRE(source != NULL); + REQUIRE(talink->common.rdtype == dns_rdatatype_talink); + + if (talink->mctx == NULL) + return; + + dns_name_free(&talink->prev, talink->mctx); + dns_name_free(&talink->next, talink->mctx); + talink->mctx = NULL; +} + +static inline isc_result_t +additionaldata_talink(ARGS_ADDLDATA) { + UNUSED(rdata); + UNUSED(add); + UNUSED(arg); + + REQUIRE(rdata->type == dns_rdatatype_talink); + + return (ISC_R_SUCCESS); +} + +static inline isc_result_t +digest_talink(ARGS_DIGEST) { + isc_region_t r; + + REQUIRE(rdata->type == dns_rdatatype_talink); + + dns_rdata_toregion(rdata, &r); + return ((digest)(arg, &r)); +} + +static inline isc_boolean_t +checkowner_talink(ARGS_CHECKOWNER) { + + REQUIRE(type == dns_rdatatype_talink); + + UNUSED(name); + UNUSED(type); + UNUSED(rdclass); + UNUSED(wildcard); + + return (ISC_TRUE); +} + +static inline isc_boolean_t +checknames_talink(ARGS_CHECKNAMES) { + + REQUIRE(rdata->type == dns_rdatatype_talink); + + UNUSED(bad); + UNUSED(owner); + + return (ISC_TRUE); +} + +static inline int +casecompare_talink(ARGS_COMPARE) { + return (compare_talink(rdata1, rdata2)); +} + +#endif /* RDATA_GENERIC_TALINK_58_C */ diff --git a/contrib/bind9/lib/dns/rdata/generic/talink_58.h b/contrib/bind9/lib/dns/rdata/generic/talink_58.h new file mode 100644 index 000000000..6e52d3818 --- /dev/null +++ b/contrib/bind9/lib/dns/rdata/generic/talink_58.h @@ -0,0 +1,29 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* http://www.iana.org/assignments/dns-parameters/TALINK/talink-completed-template */ + +#ifndef GENERIC_TALINK_58_H +#define GENERIC_TALINK_58_H 1 + +typedef struct dns_rdata_talink { + dns_rdatacommon_t common; + isc_mem_t *mctx; + dns_name_t prev; + dns_name_t next; +} dns_rdata_talink_t; + +#endif /* GENERIC_TALINK_58_H */ diff --git a/contrib/bind9/lib/dns/rdata/generic/tkey_249.c b/contrib/bind9/lib/dns/rdata/generic/tkey_249.c index e87b88065..3cf702383 100644 --- a/contrib/bind9/lib/dns/rdata/generic/tkey_249.c +++ b/contrib/bind9/lib/dns/rdata/generic/tkey_249.c @@ -50,7 +50,8 @@ fromtext_tkey(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); diff --git a/contrib/bind9/lib/dns/rdata/generic/tlsa_52.c b/contrib/bind9/lib/dns/rdata/generic/tlsa_52.c index d09a5289a..cbb73775e 100644 --- a/contrib/bind9/lib/dns/rdata/generic/tlsa_52.c +++ b/contrib/bind9/lib/dns/rdata/generic/tlsa_52.c @@ -14,8 +14,6 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ - /* rfc6698.txt */ #ifndef RDATA_GENERIC_TLSA_52_C @@ -24,11 +22,9 @@ #define RRTYPE_TLSA_ATTRIBUTES 0 static inline isc_result_t -fromtext_tlsa(ARGS_FROMTEXT) { +generic_fromtext_tlsa(ARGS_FROMTEXT) { isc_token_t token; - REQUIRE(type == dns_rdatatype_tlsa); - UNUSED(type); UNUSED(rdclass); UNUSED(origin); @@ -69,12 +65,11 @@ fromtext_tlsa(ARGS_FROMTEXT) { } static inline isc_result_t -totext_tlsa(ARGS_TOTEXT) { +generic_totext_tlsa(ARGS_TOTEXT) { isc_region_t sr; char buf[sizeof("64000 ")]; unsigned int n; - REQUIRE(rdata->type == dns_rdatatype_tlsa); REQUIRE(rdata->length != 0); UNUSED(tctx); @@ -122,11 +117,9 @@ totext_tlsa(ARGS_TOTEXT) { } static inline isc_result_t -fromwire_tlsa(ARGS_FROMWIRE) { +generic_fromwire_tlsa(ARGS_FROMWIRE) { isc_region_t sr; - REQUIRE(type == dns_rdatatype_tlsa); - UNUSED(type); UNUSED(rdclass); UNUSED(dctx); @@ -141,6 +134,32 @@ fromwire_tlsa(ARGS_FROMWIRE) { return (mem_tobuffer(target, sr.base, sr.length)); } +static inline isc_result_t +fromtext_tlsa(ARGS_FROMTEXT) { + + REQUIRE(type == dns_rdatatype_tlsa); + + return (generic_fromtext_tlsa(rdclass, type, lexer, origin, options, + target, callbacks)); +} + +static inline isc_result_t +totext_tlsa(ARGS_TOTEXT) { + + REQUIRE(rdata->type == dns_rdatatype_tlsa); + + return (generic_totext_tlsa(rdata, tctx, target)); +} + +static inline isc_result_t +fromwire_tlsa(ARGS_FROMWIRE) { + + REQUIRE(type == dns_rdatatype_tlsa); + + return (generic_fromwire_tlsa(rdclass, type, source, dctx, options, + target)); +} + static inline isc_result_t towire_tlsa(ARGS_TOWIRE) { isc_region_t sr; @@ -171,10 +190,9 @@ compare_tlsa(ARGS_COMPARE) { } static inline isc_result_t -fromstruct_tlsa(ARGS_FROMSTRUCT) { +generic_fromstruct_tlsa(ARGS_FROMSTRUCT) { dns_rdata_tlsa_t *tlsa = source; - REQUIRE(type == dns_rdatatype_tlsa); REQUIRE(source != NULL); REQUIRE(tlsa->common.rdtype == type); REQUIRE(tlsa->common.rdclass == rdclass); @@ -190,11 +208,10 @@ fromstruct_tlsa(ARGS_FROMSTRUCT) { } static inline isc_result_t -tostruct_tlsa(ARGS_TOSTRUCT) { +generic_tostruct_tlsa(ARGS_TOSTRUCT) { dns_rdata_tlsa_t *tlsa = target; isc_region_t region; - REQUIRE(rdata->type == dns_rdatatype_tlsa); REQUIRE(target != NULL); REQUIRE(rdata->length != 0); @@ -221,11 +238,10 @@ tostruct_tlsa(ARGS_TOSTRUCT) { } static inline void -freestruct_tlsa(ARGS_FREESTRUCT) { +generic_freestruct_tlsa(ARGS_FREESTRUCT) { dns_rdata_tlsa_t *tlsa = source; REQUIRE(tlsa != NULL); - REQUIRE(tlsa->common.rdtype == dns_rdatatype_tlsa); if (tlsa->mctx == NULL) return; @@ -235,6 +251,38 @@ freestruct_tlsa(ARGS_FREESTRUCT) { tlsa->mctx = NULL; } +static inline isc_result_t +fromstruct_tlsa(ARGS_FROMSTRUCT) { + + REQUIRE(type == dns_rdatatype_tlsa); + + return (generic_fromstruct_tlsa(rdclass, type, source, target)); +} + +static inline isc_result_t +tostruct_tlsa(ARGS_TOSTRUCT) { + dns_rdata_txt_t *txt = target; + + REQUIRE(rdata->type == dns_rdatatype_tlsa); + REQUIRE(target != NULL); + + txt->common.rdclass = rdata->rdclass; + txt->common.rdtype = rdata->type; + ISC_LINK_INIT(&txt->common, link); + + return (generic_tostruct_tlsa(rdata, target, mctx)); +} + +static inline void +freestruct_tlsa(ARGS_FREESTRUCT) { + dns_rdata_txt_t *txt = source; + + REQUIRE(source != NULL); + REQUIRE(txt->common.rdtype == dns_rdatatype_tlsa); + + generic_freestruct_tlsa(source); +} + static inline isc_result_t additionaldata_tlsa(ARGS_ADDLDATA) { REQUIRE(rdata->type == dns_rdatatype_tlsa); diff --git a/contrib/bind9/lib/dns/rdata/generic/txt_16.c b/contrib/bind9/lib/dns/rdata/generic/txt_16.c index aa7c3a0ab..2ebd46c31 100644 --- a/contrib/bind9/lib/dns/rdata/generic/txt_16.c +++ b/contrib/bind9/lib/dns/rdata/generic/txt_16.c @@ -15,8 +15,6 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: txt_16.c,v 1.47 2009/12/04 22:06:37 tbox Exp $ */ - /* Reviewed: Thu Mar 16 15:40:00 PST 2000 by bwelling */ #ifndef RDATA_GENERIC_TXT_16_C @@ -25,12 +23,10 @@ #define RRTYPE_TXT_ATTRIBUTES (0) static inline isc_result_t -fromtext_txt(ARGS_FROMTEXT) { +generic_fromtext_txt(ARGS_FROMTEXT) { isc_token_t token; int strings; - REQUIRE(type == dns_rdatatype_txt); - UNUSED(type); UNUSED(rdclass); UNUSED(origin); @@ -61,13 +57,11 @@ fromtext_txt(ARGS_FROMTEXT) { } static inline isc_result_t -totext_txt(ARGS_TOTEXT) { +generic_totext_txt(ARGS_TOTEXT) { isc_region_t region; UNUSED(tctx); - REQUIRE(rdata->type == dns_rdatatype_txt); - dns_rdata_toregion(rdata, ®ion); while (region.length > 0) { @@ -80,11 +74,9 @@ totext_txt(ARGS_TOTEXT) { } static inline isc_result_t -fromwire_txt(ARGS_FROMWIRE) { +generic_fromwire_txt(ARGS_FROMWIRE) { isc_result_t result; - REQUIRE(type == dns_rdatatype_txt); - UNUSED(type); UNUSED(dctx); UNUSED(rdclass); @@ -98,21 +90,40 @@ fromwire_txt(ARGS_FROMWIRE) { return (ISC_R_SUCCESS); } +static inline isc_result_t +fromtext_txt(ARGS_FROMTEXT) { + + REQUIRE(type == dns_rdatatype_txt); + + return (generic_fromtext_txt(rdclass, type, lexer, origin, options, + target, callbacks)); +} + +static inline isc_result_t +totext_txt(ARGS_TOTEXT) { + + REQUIRE(rdata->type == dns_rdatatype_txt); + + return (generic_totext_txt(rdata, tctx, target)); +} + +static inline isc_result_t +fromwire_txt(ARGS_FROMWIRE) { + + REQUIRE(type == dns_rdatatype_txt); + + return (generic_fromwire_txt(rdclass, type, source, dctx, options, + target)); +} + static inline isc_result_t towire_txt(ARGS_TOWIRE) { - isc_region_t region; REQUIRE(rdata->type == dns_rdatatype_txt); UNUSED(cctx); - isc_buffer_availableregion(target, ®ion); - if (region.length < rdata->length) - return (ISC_R_NOSPACE); - - memmove(region.base, rdata->data, rdata->length); - isc_buffer_add(target, rdata->length); - return (ISC_R_SUCCESS); + return (mem_tobuffer(target, rdata->data, rdata->length)); } static inline int @@ -130,12 +141,11 @@ compare_txt(ARGS_COMPARE) { } static inline isc_result_t -fromstruct_txt(ARGS_FROMSTRUCT) { +generic_fromstruct_txt(ARGS_FROMSTRUCT) { dns_rdata_txt_t *txt = source; isc_region_t region; isc_uint8_t length; - REQUIRE(type == dns_rdatatype_txt); REQUIRE(source != NULL); REQUIRE(txt->common.rdtype == type); REQUIRE(txt->common.rdclass == rdclass); @@ -158,16 +168,14 @@ fromstruct_txt(ARGS_FROMSTRUCT) { } static inline isc_result_t -tostruct_txt(ARGS_TOSTRUCT) { +generic_tostruct_txt(ARGS_TOSTRUCT) { dns_rdata_txt_t *txt = target; isc_region_t r; - REQUIRE(rdata->type == dns_rdatatype_txt); REQUIRE(target != NULL); - - txt->common.rdclass = rdata->rdclass; - txt->common.rdtype = rdata->type; - ISC_LINK_INIT(&txt->common, link); + REQUIRE(txt->common.rdclass == rdata->rdclass); + REQUIRE(txt->common.rdtype == rdata->type); + REQUIRE(!ISC_LINK_LINKED(&txt->common, link)); dns_rdata_toregion(rdata, &r); txt->txt_len = r.length; @@ -181,11 +189,10 @@ tostruct_txt(ARGS_TOSTRUCT) { } static inline void -freestruct_txt(ARGS_FREESTRUCT) { +generic_freestruct_txt(ARGS_FREESTRUCT) { dns_rdata_txt_t *txt = source; REQUIRE(source != NULL); - REQUIRE(txt->common.rdtype == dns_rdatatype_txt); if (txt->mctx == NULL) return; @@ -195,6 +202,38 @@ freestruct_txt(ARGS_FREESTRUCT) { txt->mctx = NULL; } +static inline isc_result_t +fromstruct_txt(ARGS_FROMSTRUCT) { + + REQUIRE(type == dns_rdatatype_txt); + + return (generic_fromstruct_txt(rdclass, type, source, target)); +} + +static inline isc_result_t +tostruct_txt(ARGS_TOSTRUCT) { + dns_rdata_txt_t *txt = target; + + REQUIRE(rdata->type == dns_rdatatype_txt); + REQUIRE(target != NULL); + + txt->common.rdclass = rdata->rdclass; + txt->common.rdtype = rdata->type; + ISC_LINK_INIT(&txt->common, link); + + return (generic_tostruct_txt(rdata, target, mctx)); +} + +static inline void +freestruct_txt(ARGS_FREESTRUCT) { + dns_rdata_txt_t *txt = source; + + REQUIRE(source != NULL); + REQUIRE(txt->common.rdtype == dns_rdatatype_txt); + + generic_freestruct_txt(source); +} + static inline isc_result_t additionaldata_txt(ARGS_ADDLDATA) { REQUIRE(rdata->type == dns_rdatatype_txt); @@ -247,11 +286,10 @@ casecompare_txt(ARGS_COMPARE) { return (compare_txt(rdata1, rdata2)); } -isc_result_t -dns_rdata_txt_first(dns_rdata_txt_t *txt) { +static isc_result_t +generic_txt_first(dns_rdata_txt_t *txt) { REQUIRE(txt != NULL); - REQUIRE(txt->common.rdtype == dns_rdatatype_txt); REQUIRE(txt->txt != NULL || txt->txt_len == 0); if (txt->txt_len == 0) @@ -261,13 +299,12 @@ dns_rdata_txt_first(dns_rdata_txt_t *txt) { return (ISC_R_SUCCESS); } -isc_result_t -dns_rdata_txt_next(dns_rdata_txt_t *txt) { +static isc_result_t +generic_txt_next(dns_rdata_txt_t *txt) { isc_region_t r; isc_uint8_t length; REQUIRE(txt != NULL); - REQUIRE(txt->common.rdtype == dns_rdatatype_txt); REQUIRE(txt->txt != NULL && txt->txt_len != 0); INSIST(txt->offset + 1 <= txt->txt_len); @@ -281,13 +318,12 @@ dns_rdata_txt_next(dns_rdata_txt_t *txt) { return (ISC_R_SUCCESS); } -isc_result_t -dns_rdata_txt_current(dns_rdata_txt_t *txt, dns_rdata_txt_string_t *string) { +static isc_result_t +generic_txt_current(dns_rdata_txt_t *txt, dns_rdata_txt_string_t *string) { isc_region_t r; REQUIRE(txt != NULL); REQUIRE(string != NULL); - REQUIRE(txt->common.rdtype == dns_rdatatype_txt); REQUIRE(txt->txt != NULL); REQUIRE(txt->offset < txt->txt_len); @@ -302,4 +338,31 @@ dns_rdata_txt_current(dns_rdata_txt_t *txt, dns_rdata_txt_string_t *string) { return (ISC_R_SUCCESS); } + +isc_result_t +dns_rdata_txt_first(dns_rdata_txt_t *txt) { + + REQUIRE(txt != NULL); + REQUIRE(txt->common.rdtype == dns_rdatatype_txt); + + return (generic_txt_first(txt)); +} + +isc_result_t +dns_rdata_txt_next(dns_rdata_txt_t *txt) { + + REQUIRE(txt != NULL); + REQUIRE(txt->common.rdtype == dns_rdatatype_txt); + + return (generic_txt_next(txt)); +} + +isc_result_t +dns_rdata_txt_current(dns_rdata_txt_t *txt, dns_rdata_txt_string_t *string) { + + REQUIRE(txt != NULL); + REQUIRE(txt->common.rdtype == dns_rdatatype_txt); + + return (generic_txt_current(txt, string)); +} #endif /* RDATA_GENERIC_TXT_16_C */ diff --git a/contrib/bind9/lib/dns/rdata/in_1/a6_38.c b/contrib/bind9/lib/dns/rdata/in_1/a6_38.c index 05a21ade8..d8b76e54b 100644 --- a/contrib/bind9/lib/dns/rdata/in_1/a6_38.c +++ b/contrib/bind9/lib/dns/rdata/in_1/a6_38.c @@ -83,7 +83,8 @@ fromtext_in_a6(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); ok = ISC_TRUE; if ((options & DNS_RDATA_CHECKNAMES) != 0) diff --git a/contrib/bind9/lib/dns/rdata/in_1/kx_36.c b/contrib/bind9/lib/dns/rdata/in_1/kx_36.c index 8b911eb07..9a4130571 100644 --- a/contrib/bind9/lib/dns/rdata/in_1/kx_36.c +++ b/contrib/bind9/lib/dns/rdata/in_1/kx_36.c @@ -49,7 +49,8 @@ fromtext_in_kx(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); return (ISC_R_SUCCESS); } diff --git a/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.c b/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.c index d8b43f2ed..764a85c09 100644 --- a/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.c +++ b/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.c @@ -44,7 +44,8 @@ fromtext_in_nsap_ptr(ARGS_FROMTEXT) { dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); return (ISC_R_SUCCESS); } diff --git a/contrib/bind9/lib/dns/rdata/in_1/px_26.c b/contrib/bind9/lib/dns/rdata/in_1/px_26.c index 4cf0ae418..11d145ae2 100644 --- a/contrib/bind9/lib/dns/rdata/in_1/px_26.c +++ b/contrib/bind9/lib/dns/rdata/in_1/px_26.c @@ -39,6 +39,9 @@ fromtext_in_px(ARGS_FROMTEXT) { UNUSED(rdclass); UNUSED(callbacks); + if (origin == NULL) + origin = dns_rootname; + /* * Preference. */ @@ -55,7 +58,6 @@ fromtext_in_px(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); /* @@ -65,7 +67,6 @@ fromtext_in_px(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); return (ISC_R_SUCCESS); } diff --git a/contrib/bind9/lib/dns/rdata/in_1/srv_33.c b/contrib/bind9/lib/dns/rdata/in_1/srv_33.c index b97d41027..15b29d544 100644 --- a/contrib/bind9/lib/dns/rdata/in_1/srv_33.c +++ b/contrib/bind9/lib/dns/rdata/in_1/srv_33.c @@ -74,7 +74,8 @@ fromtext_in_srv(ARGS_FROMTEXT) { ISC_FALSE)); dns_name_init(&name, NULL); buffer_fromregion(&buffer, &token.value.as_region); - origin = (origin != NULL) ? origin : dns_rootname; + if (origin == NULL) + origin = dns_rootname; RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); ok = ISC_TRUE; if ((options & DNS_RDATA_CHECKNAMES) != 0) diff --git a/contrib/bind9/lib/dns/resolver.c b/contrib/bind9/lib/dns/resolver.c index 30f9be7da..5f75bc083 100644 --- a/contrib/bind9/lib/dns/resolver.c +++ b/contrib/bind9/lib/dns/resolver.c @@ -103,6 +103,13 @@ "fctx %p(%s): [result: %s] %s %s", \ fctx, fctx->info, \ isc_result_totext(res), (m1), (m2)) +#define FCTXTRACE5(m1, m2, v) \ + isc_log_write(dns_lctx, \ + DNS_LOGCATEGORY_RESOLVER, \ + DNS_LOGMODULE_RESOLVER, \ + ISC_LOG_DEBUG(3), \ + "fctx %p(%s): %s %s%u", \ + fctx, fctx->info, (m1), (m2), (v)) #define FTRACE(m) isc_log_write(dns_lctx, \ DNS_LOGCATEGORY_RESOLVER, \ DNS_LOGMODULE_RESOLVER, \ @@ -125,6 +132,8 @@ #define FCTXTRACE3(m1, res) do { UNUSED(m1); UNUSED(res); } while (0) #define FCTXTRACE4(m1, m2, res) \ do { UNUSED(m1); UNUSED(m2); UNUSED(res); } while (0) +#define FCTXTRACE5(m1, m2, v) \ + do { UNUSED(m1); UNUSED(m2); UNUSED(v); } while (0) #define FTRACE(m) do { UNUSED(m); } while (0) #define QTRACE(m) do { UNUSED(m); } while (0) #endif /* WANT_QUERYTRACE */ @@ -866,7 +875,8 @@ resquery_destroy(resquery_t **queryp) { static void fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp, - isc_time_t *finish, isc_boolean_t no_response) + isc_time_t *finish, isc_boolean_t no_response, + isc_boolean_t age_untried) { fetchctx_t *fctx; resquery_t *query; @@ -948,14 +958,14 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp, * Age RTTs of servers not tried. */ isc_stdtime_get(&now); - if (finish != NULL) + if (finish != NULL || age_untried) for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs); addrinfo != NULL; addrinfo = ISC_LIST_NEXT(addrinfo, publink)) if (UNMARKED(addrinfo)) dns_adb_agesrtt(fctx->adb, addrinfo, now); - if (finish != NULL && TRIEDFIND(fctx)) + if ((finish != NULL || age_untried) && TRIEDFIND(fctx)) for (find = ISC_LIST_HEAD(fctx->finds); find != NULL; find = ISC_LIST_NEXT(find, publink)) @@ -966,7 +976,7 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp, dns_adb_agesrtt(fctx->adb, addrinfo, now); - if (finish != NULL && TRIEDALT(fctx)) { + if ((finish != NULL || age_untried) && TRIEDALT(fctx)) { for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL; addrinfo = ISC_LIST_NEXT(addrinfo, publink)) @@ -1037,7 +1047,9 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp, } static void -fctx_cancelqueries(fetchctx_t *fctx, isc_boolean_t no_response) { +fctx_cancelqueries(fetchctx_t *fctx, isc_boolean_t no_response, + isc_boolean_t age_untried) +{ resquery_t *query, *next_query; FCTXTRACE("cancelqueries"); @@ -1046,7 +1058,8 @@ fctx_cancelqueries(fetchctx_t *fctx, isc_boolean_t no_response) { query != NULL; query = next_query) { next_query = ISC_LIST_NEXT(query, link); - fctx_cancelquery(&query, NULL, NULL, no_response); + fctx_cancelquery(&query, NULL, NULL, no_response, + age_untried); } } @@ -1113,9 +1126,11 @@ fctx_cleanupaltaddrs(fetchctx_t *fctx) { } static inline void -fctx_stopeverything(fetchctx_t *fctx, isc_boolean_t no_response) { +fctx_stopeverything(fetchctx_t *fctx, isc_boolean_t no_response, + isc_boolean_t age_untried) +{ FCTXTRACE("stopeverything"); - fctx_cancelqueries(fctx, no_response); + fctx_cancelqueries(fctx, no_response, age_untried); fctx_cleanupfinds(fctx); fctx_cleanupaltfinds(fctx); fctx_cleanupforwaddrs(fctx); @@ -1354,7 +1369,8 @@ log_edns(fetchctx_t *fctx) { static void fctx_done(fetchctx_t *fctx, isc_result_t result, int line) { dns_resolver_t *res; - isc_boolean_t no_response; + isc_boolean_t no_response = ISC_FALSE; + isc_boolean_t age_untried = ISC_FALSE; REQUIRE(line >= 0); @@ -1368,11 +1384,11 @@ fctx_done(fetchctx_t *fctx, isc_result_t result, int line) { */ log_edns(fctx); no_response = ISC_TRUE; - } else - no_response = ISC_FALSE; + } else if (result == ISC_R_TIMEDOUT) + age_untried = ISC_TRUE; fctx->reason = NULL; - fctx_stopeverything(fctx, no_response); + fctx_stopeverything(fctx, no_response, age_untried); LOCK(&res->buckets[fctx->bucketnum].lock); @@ -1422,7 +1438,8 @@ process_sendevent(resquery_t *query, isc_event_t *event) { */ add_bad(fctx, query->addrinfo, sevent->result, badns_unreachable); - fctx_cancelquery(&query, NULL, NULL, ISC_TRUE); + fctx_cancelquery(&query, NULL, NULL, ISC_TRUE, + ISC_FALSE); retry = ISC_TRUE; break; @@ -1431,7 +1448,8 @@ process_sendevent(resquery_t *query, isc_event_t *event) { "unexpected event result; responding", sevent->result); - fctx_cancelquery(&query, NULL, NULL, ISC_FALSE); + fctx_cancelquery(&query, NULL, NULL, ISC_FALSE, + ISC_FALSE); break; } } @@ -2327,7 +2345,8 @@ resquery_connected(isc_task_t *task, isc_event_t *event) { FCTXTRACE("query canceled: idle timer failed; " "responding"); - fctx_cancelquery(&query, NULL, NULL, ISC_FALSE); + fctx_cancelquery(&query, NULL, NULL, ISC_FALSE, + ISC_FALSE); fctx_done(fctx, result, __LINE__); break; } @@ -2366,7 +2385,7 @@ resquery_connected(isc_task_t *task, isc_event_t *event) { FCTXTRACE("query canceled: " "resquery_send() failed; responding"); - fctx_cancelquery(&query, NULL, NULL, ISC_FALSE); + fctx_cancelquery(&query, NULL, NULL, ISC_FALSE, ISC_FALSE); fctx_done(fctx, result, __LINE__); } break; @@ -2385,7 +2404,7 @@ resquery_connected(isc_task_t *task, isc_event_t *event) { * No route to remote. */ isc_socket_detach(&query->tcpsocket); - fctx_cancelquery(&query, NULL, NULL, ISC_TRUE); + fctx_cancelquery(&query, NULL, NULL, ISC_TRUE, ISC_FALSE); retry = ISC_TRUE; break; @@ -2395,7 +2414,7 @@ resquery_connected(isc_task_t *task, isc_event_t *event) { sevent->result); isc_socket_detach(&query->tcpsocket); - fctx_cancelquery(&query, NULL, NULL, ISC_FALSE); + fctx_cancelquery(&query, NULL, NULL, ISC_FALSE, ISC_FALSE); break; } } @@ -2858,7 +2877,7 @@ fctx_getaddresses(fetchctx_t *fctx, isc_boolean_t badcache) { isc_boolean_t all_spilled = ISC_TRUE; #endif /* ENABLE_FETCHLIMIT */ - FCTXTRACE("getaddresses"); + FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth); /* * Don't pound on remote servers. (Failsafe!) @@ -2874,8 +2893,9 @@ fctx_getaddresses(fetchctx_t *fctx, isc_boolean_t badcache) { if (fctx->depth > res->maxdepth) { isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), - "too much NS indirection resolving '%s'", - fctx->info); + "too much NS indirection resolving '%s' " + "(depth=%u, maxdepth=%u)", + fctx->info, fctx->depth, res->maxdepth); return (DNS_R_SERVFAIL); } @@ -3172,6 +3192,9 @@ possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) if (aborted) { addr->flags |= FCTX_ADDRINFO_MARK; msg = "ignoring blackholed / bogus server: "; + } else if (isc_sockaddr_isnetzero(sa)) { + addr->flags |= FCTX_ADDRINFO_MARK; + msg = "ignoring net zero address: "; } else if (isc_sockaddr_ismulticast(sa)) { addr->flags |= FCTX_ADDRINFO_MARK; msg = "ignoring multicast address: "; @@ -3346,7 +3369,7 @@ fctx_try(fetchctx_t *fctx, isc_boolean_t retrying, isc_boolean_t badcache) { unsigned int bucketnum; isc_boolean_t bucket_empty; - FCTXTRACE("try"); + FCTXTRACE5("try", "fctx->qc=", isc_counter_used(fctx->qc)); REQUIRE(!ADDRWAIT(fctx)); @@ -3356,8 +3379,10 @@ fctx_try(fetchctx_t *fctx, isc_boolean_t retrying, isc_boolean_t badcache) { if (isc_counter_used(fctx->qc) > res->maxqueries) { isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), - "exceeded max queries resolving '%s'", - fctx->info); + "exceeded max queries resolving '%s' " + "(querycount=%u, maxqueries=%u)", + fctx->info, + isc_counter_used(fctx->qc), res->maxqueries); fctx_done(fctx, DNS_R_SERVFAIL, __LINE__); return; } @@ -3371,7 +3396,7 @@ fctx_try(fetchctx_t *fctx, isc_boolean_t retrying, isc_boolean_t badcache) { if (addrinfo == NULL) { /* We have no more addresses. Start over. */ - fctx_cancelqueries(fctx, ISC_TRUE); + fctx_cancelqueries(fctx, ISC_TRUE, ISC_FALSE); fctx_cleanupfinds(fctx); fctx_cleanupaltfinds(fctx); fctx_cleanupforwaddrs(fctx); @@ -3589,7 +3614,7 @@ fctx_timeout(isc_task_t *task, isc_event_t *event) { isc_time_compare(&tevent->due, &query->start) >= 0) { FCTXTRACE("query timed out; no response"); - fctx_cancelquery(&query, NULL, NULL, ISC_TRUE); + fctx_cancelquery(&query, NULL, NULL, ISC_TRUE, ISC_FALSE); } fctx->attributes &= ~FCTX_ATTR_ADDRWAIT; @@ -3683,7 +3708,7 @@ fctx_doshutdown(isc_task_t *task, isc_event_t *event) { * fetch. To avoid deadlock with the ADB, we must do this * before we lock the bucket lock. */ - fctx_stopeverything(fctx, ISC_FALSE); + fctx_stopeverything(fctx, ISC_FALSE, ISC_FALSE); LOCK(&res->buckets[bucketnum].lock); @@ -4025,13 +4050,12 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, &fctx->nameservers, NULL); if (result != ISC_R_SUCCESS) - goto cleanup_name; + goto cleanup_nameservers; result = dns_name_dup(domain, mctx, &fctx->domain); - if (result != ISC_R_SUCCESS) { - dns_rdataset_disassociate(&fctx->nameservers); - goto cleanup_name; - } + if (result != ISC_R_SUCCESS) + goto cleanup_nameservers; + fctx->ns_ttl = fctx->nameservers.ttl; fctx->ns_ttl_ok = ISC_TRUE; } else { @@ -4160,6 +4184,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, cleanup_domain: if (dns_name_countlabels(&fctx->domain) > 0) dns_name_free(&fctx->domain, mctx); + + cleanup_nameservers: if (dns_rdataset_isassociated(&fctx->nameservers)) dns_rdataset_disassociate(&fctx->nameservers); @@ -7395,7 +7421,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) { } } - dns_message_setclass(message, fctx->res->rdclass); + dns_message_setclass(message, res->rdclass); if ((options & DNS_FETCHOPT_TCP) == 0) dns_adb_plainresponse(fctx->adb, query->addrinfo); @@ -7472,7 +7498,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) { */ log_packet(message, ISC_LOG_DEBUG(10), res->mctx); - if (message->rdclass != fctx->res->rdclass) { + if (message->rdclass != res->rdclass) { resend = ISC_TRUE; FCTXTRACE("bad class"); goto done; @@ -7945,7 +7971,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) { * * XXXRTH Don't cancel the query if waiting for validation? */ - fctx_cancelquery(&query, &devent, finish, no_response); + fctx_cancelquery(&query, &devent, finish, no_response, ISC_FALSE); if (keep_trying) { if (result == DNS_R_FORMERR) @@ -8016,7 +8042,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) { fctx->ns_ttl = fctx->nameservers.ttl; fctx->ns_ttl_ok = ISC_TRUE; - fctx_cancelqueries(fctx, ISC_TRUE); + fctx_cancelqueries(fctx, ISC_TRUE, ISC_FALSE); fctx_cleanupfinds(fctx); fctx_cleanupaltfinds(fctx); fctx_cleanupforwaddrs(fctx); @@ -8049,7 +8075,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) { * DNSSEC validator to validate the answer. */ FCTXTRACE("wait for validator"); - fctx_cancelqueries(fctx, ISC_TRUE); + fctx_cancelqueries(fctx, ISC_TRUE, ISC_FALSE); /* * We must not retransmit while the validator is working; * it has references to the current rmessage. @@ -8060,7 +8086,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) { } else if (result == DNS_R_CHASEDSSERVERS) { unsigned int n; add_bad(fctx, addrinfo, result, broken_type); - fctx_cancelqueries(fctx, ISC_TRUE); + fctx_cancelqueries(fctx, ISC_TRUE, ISC_FALSE); fctx_cleanupfinds(fctx); fctx_cleanupforwaddrs(fctx); @@ -8586,6 +8612,7 @@ dns_resolver_prime(dns_resolver_t *res) { &res->primefetch); UNLOCK(&res->primelock); if (result != ISC_R_SUCCESS) { + isc_mem_put(res->mctx, rdataset, sizeof(*rdataset)); LOCK(&res->lock); INSIST(res->priming); res->priming = ISC_FALSE; diff --git a/contrib/bind9/lib/dns/rootns.c b/contrib/bind9/lib/dns/rootns.c index 97b510120..d395855ea 100644 --- a/contrib/bind9/lib/dns/rootns.c +++ b/contrib/bind9/lib/dns/rootns.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2008, 2010, 2012-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2008, 2010, 2012-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -79,7 +79,7 @@ static char root_ns[] = "K.ROOT-SERVERS.NET. 3600000 IN A 193.0.14.129\n" "K.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:7FD::1\n" "L.ROOT-SERVERS.NET. 3600000 IN A 199.7.83.42\n" -"L.ROOT-SERVERS.NET. 604800 IN AAAA 2001:500:3::42\n" +"L.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:9f::42\n" "M.ROOT-SERVERS.NET. 3600000 IN A 202.12.27.33\n" "M.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:DC3::35\n"; diff --git a/contrib/bind9/lib/dns/sdlz.c b/contrib/bind9/lib/dns/sdlz.c index 3b245419d..e70532021 100644 --- a/contrib/bind9/lib/dns/sdlz.c +++ b/contrib/bind9/lib/dns/sdlz.c @@ -606,7 +606,7 @@ findnodeext(dns_db_t *db, dns_name_t *name, isc_boolean_t create, * if the host (namestr) was not found, try to lookup a * "wildcard" host. */ - if (result != ISC_R_SUCCESS && !create) + if (result == ISC_R_NOTFOUND && !create) result = sdlz->dlzimp->methods->lookup(zonestr, "*", sdlz->dlzimp->driverarg, sdlz->dbdata, node, @@ -614,7 +614,10 @@ findnodeext(dns_db_t *db, dns_name_t *name, isc_boolean_t create, MAYBE_UNLOCK(sdlz->dlzimp); - if (result != ISC_R_SUCCESS && !isorigin && !create) { + if (result == ISC_R_NOTFOUND && (isorigin || create)) + result = ISC_R_SUCCESS; + + if (result != ISC_R_SUCCESS) { destroynode(node); return (result); } @@ -879,10 +882,11 @@ findext(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version, dns_name_getlabelsequence(name, nlabels - i, i, xname); result = findnodeext(db, xname, ISC_FALSE, methods, clientinfo, &node); - if (result != ISC_R_SUCCESS) { + if (result == ISC_R_NOTFOUND) { result = DNS_R_NXDOMAIN; continue; - } + } else if (result != ISC_R_SUCCESS) + break; /* * Look for a DNAME at the current label, unless this is diff --git a/contrib/bind9/lib/dns/tkey.c b/contrib/bind9/lib/dns/tkey.c index 0b5440a67..0012bbff4 100644 --- a/contrib/bind9/lib/dns/tkey.c +++ b/contrib/bind9/lib/dns/tkey.c @@ -987,7 +987,7 @@ dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name, if (nonce != NULL) isc_buffer_usedregion(nonce, &r); else { - r.base = isc_mem_get(msg->mctx, 0); + r.base = NULL; r.length = 0; } tkey.error = 0; @@ -998,9 +998,6 @@ dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name, RETERR(buildquery(msg, name, &tkey, ISC_FALSE)); - if (nonce == NULL) - isc_mem_put(msg->mctx, r.base, 0); - RETERR(dns_message_gettemprdata(msg, &rdata)); RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 1024)); RETERR(dst_key_todns(key, dynbuf)); @@ -1231,12 +1228,10 @@ dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg, if (nonce != NULL) isc_buffer_usedregion(nonce, &r2); else { - r2.base = isc_mem_get(rmsg->mctx, 0); + r2.base = NULL; r2.length = 0; } RETERR(compute_secret(shared, &r2, &r, &secret)); - if (nonce == NULL) - isc_mem_put(rmsg->mctx, r2.base, 0); isc_buffer_usedregion(&secret, &r); result = dns_tsigkey_create(tkeyname, &rtkey.algorithm, diff --git a/contrib/bind9/lib/dns/update.c b/contrib/bind9/lib/dns/update.c index 268e25047..10910ca50 100644 --- a/contrib/bind9/lib/dns/update.c +++ b/contrib/bind9/lib/dns/update.c @@ -1360,7 +1360,7 @@ struct dns_update_state { unsigned int nkeys; isc_stdtime_t inception, expire; dns_ttl_t nsecttl; - isc_boolean_t check_ksk, keyset_kskonly; + isc_boolean_t check_ksk, keyset_kskonly, build_nsec3; enum { sign_updates, remove_orphaned, build_chain, process_nsec, sign_nsec, update_nsec3, process_nsec3, sign_nsec3 } state; }; @@ -1375,7 +1375,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, dns_update_state_t mystate, *state; dns_difftuple_t *t, *next; - isc_boolean_t flag, build_nsec, build_nsec3; + isc_boolean_t flag, build_nsec; unsigned int i; isc_stdtime_t now; dns_rdata_soa_t soa; @@ -1404,6 +1404,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, dns_diff_init(diff->mctx, &state->nsec_mindiff); dns_diff_init(diff->mctx, &state->work); state->nkeys = 0; + state->build_nsec3 = ISC_FALSE; result = find_zone_keys(zone, db, newver, diff->mctx, DNS_MAXZONEKEYS, state->zone_keys, @@ -1568,7 +1569,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, * See if we need to build NSEC or NSEC3 chains. */ CHECK(dns_private_chains(db, newver, privatetype, &build_nsec, - &build_nsec3)); + &state->build_nsec3)); if (!build_nsec) { state->state = update_nsec3; goto next_state; @@ -1831,7 +1832,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db, INSIST(ISC_LIST_EMPTY(state->nsec_diff.tuples)); INSIST(ISC_LIST_EMPTY(state->nsec_mindiff.tuples)); - if (!build_nsec3) { + if (!state->build_nsec3) { update_log(log, zone, ISC_LOG_DEBUG(3), "no NSEC3 chains to rebuild"); goto failure; diff --git a/contrib/bind9/lib/dns/view.c b/contrib/bind9/lib/dns/view.c index da1136c07..5876a4b9d 100644 --- a/contrib/bind9/lib/dns/view.c +++ b/contrib/bind9/lib/dns/view.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -1846,14 +1846,29 @@ dns_view_untrust(dns_view_t *view, dns_name_t *keyname, isc_buffer_init(&buffer, data, sizeof(data)); dns_rdata_fromstruct(&rdata, dnskey->common.rdclass, dns_rdatatype_dnskey, dnskey, &buffer); + result = dns_dnssec_keyfromrdata(keyname, &rdata, mctx, &key); if (result != ISC_R_SUCCESS) return; + result = dns_view_getsecroots(view, &sr); if (result == ISC_R_SUCCESS) { - dns_keytable_deletekeynode(sr, key); + result = dns_keytable_deletekeynode(sr, key); + + /* + * If key was found in secroots, then it was a + * configured trust anchor, and we want to fail + * secure. If there are no other configured keys, + * then leave a null key so that we can't validate + * anymore. + */ + + if (result == ISC_R_SUCCESS) + dns_keytable_marksecure(sr, keyname); + dns_keytable_detach(&sr); } + dst_key_free(&key); } diff --git a/contrib/bind9/lib/dns/xfrin.c b/contrib/bind9/lib/dns/xfrin.c index a2bc35dc8..aec238d3f 100644 --- a/contrib/bind9/lib/dns/xfrin.c +++ b/contrib/bind9/lib/dns/xfrin.c @@ -292,6 +292,9 @@ axfr_putdata(dns_xfrin_ctx_t *xfr, dns_diffop_t op, dns_difftuple_t *tuple = NULL; + if (rdata->rdclass != xfr->rdclass) + return(DNS_R_BADCLASS); + CHECK(dns_zone_checknames(xfr->zone, name, rdata)); CHECK(dns_difftuple_create(xfr->diff.mctx, op, name, ttl, rdata, &tuple)); @@ -377,8 +380,11 @@ ixfr_putdata(dns_xfrin_ctx_t *xfr, dns_diffop_t op, dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata) { isc_result_t result; - dns_difftuple_t *tuple = NULL; + + if (rdata->rdclass != xfr->rdclass) + return(DNS_R_BADCLASS); + if (op == DNS_DIFFOP_ADD) CHECK(dns_zone_checknames(xfr->zone, name, rdata)); CHECK(dns_difftuple_create(xfr->diff.mctx, op, @@ -1224,10 +1230,17 @@ xfrin_recv_done(isc_task_t *task, isc_event_t *ev) { DNS_MESSAGEPARSE_PRESERVEORDER); if (result != ISC_R_SUCCESS || msg->rcode != dns_rcode_noerror || + msg->opcode != dns_opcode_query ||msg->rdclass != xfr->rdclass || (xfr->checkid && msg->id != xfr->id)) { - if (result == ISC_R_SUCCESS) + if (result == ISC_R_SUCCESS && msg->rcode != dns_rcode_noerror) result = ISC_RESULTCLASS_DNSRCODE + msg->rcode; /*XXX*/ - if (result == ISC_R_SUCCESS || result == DNS_R_NOERROR) + else if (result == ISC_R_SUCCESS && + msg->opcode != dns_opcode_query) + result = DNS_R_UNEXPECTEDOPCODE; + else if (result == ISC_R_SUCCESS && + msg->rdclass != xfr->rdclass) + result = DNS_R_BADCLASS; + else if (result == ISC_R_SUCCESS || result == DNS_R_NOERROR) result = DNS_R_UNEXPECTEDID; if (xfr->reqtype == dns_rdatatype_axfr || xfr->reqtype == dns_rdatatype_soa) diff --git a/contrib/bind9/lib/dns/zone.c b/contrib/bind9/lib/dns/zone.c index d334bebc4..490248a68 100644 --- a/contrib/bind9/lib/dns/zone.c +++ b/contrib/bind9/lib/dns/zone.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -1052,6 +1052,8 @@ zone_free(dns_zone_t *zone) { isc_task_detach(&zone->task); if (zone->loadtask != NULL) isc_task_detach(&zone->loadtask); + if (zone->view != NULL) + dns_view_weakdetach(&zone->view); /* Unmanaged objects */ for (signing = ISC_LIST_HEAD(zone->signing); @@ -3408,7 +3410,8 @@ compute_tag(dns_name_t *name, dns_rdata_dnskey_t *dnskey, isc_mem_t *mctx, */ static void trust_key(dns_zone_t *zone, dns_name_t *keyname, - dns_rdata_dnskey_t *dnskey, isc_mem_t *mctx) { + dns_rdata_dnskey_t *dnskey, isc_mem_t *mctx) +{ isc_result_t result; dns_rdata_t rdata = DNS_RDATA_INIT; unsigned char data[4096]; @@ -8540,13 +8543,12 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) { */ deletekey = ISC_TRUE; } else if (keydata.removehd == 0) { - /* Remove from secroots */ + /* + * Remove key from secroots. + */ dns_view_untrust(zone->view, keyname, &dnskey, mctx); - /* But ensure there's a null key */ - fail_secure(zone, keyname); - /* If initializing, delete now */ if (keydata.addhd == 0) deletekey = ISC_TRUE; @@ -8855,7 +8857,8 @@ zone_refreshkeys(dns_zone_t *zone) { result = dns_resolver_createfetch(zone->view->resolver, kname, dns_rdatatype_dnskey, NULL, NULL, NULL, - DNS_FETCHOPT_NOVALIDATE, + DNS_FETCHOPT_NOVALIDATE| + DNS_FETCHOPT_UNSHARED, zone->task, keyfetch_done, kfetch, &kfetch->dnskeyset, @@ -9303,6 +9306,7 @@ static void dump_done(void *arg, isc_result_t result) { const char me[] = "dump_done"; dns_zone_t *zone = arg; + dns_zone_t *secure = NULL; dns_db_t *db; dns_dbversion_t *version; isc_boolean_t again = ISC_FALSE; @@ -9316,30 +9320,54 @@ dump_done(void *arg, isc_result_t result) { if (result == ISC_R_SUCCESS && zone->journal != NULL && zone->journalsize != -1) { - /* * We don't own these, zone->dctx must stay valid. */ db = dns_dumpctx_db(zone->dctx); version = dns_dumpctx_version(zone->dctx); - tresult = dns_db_getsoaserial(db, version, &serial); + + /* + * Handle lock order inversion. + */ + again: + LOCK_ZONE(zone); + if (inline_raw(zone)) { + secure = zone->secure; + INSIST(secure != zone); + TRYLOCK_ZONE(result, secure); + if (result != ISC_R_SUCCESS) { + UNLOCK_ZONE(zone); + secure = NULL; +#if ISC_PLATFORM_USETHREADS + isc_thread_yield(); +#endif + goto again; + } + } + /* * If there is a secure version of this zone * use its serial if it is less than ours. */ - if (tresult == ISC_R_SUCCESS && inline_raw(zone) && - zone->secure->db != NULL) - { + if (tresult == ISC_R_SUCCESS && secure != NULL) { isc_uint32_t sserial; isc_result_t mresult; - mresult = dns_db_getsoaserial(zone->secure->db, - NULL, &sserial); - if (mresult == ISC_R_SUCCESS && - isc_serial_lt(sserial, serial)) - serial = sserial; + ZONEDB_LOCK(&secure->dblock, isc_rwlocktype_read); + if (secure->db != NULL) { + mresult = dns_db_getsoaserial(zone->secure->db, + NULL, &sserial); + if (mresult == ISC_R_SUCCESS && + isc_serial_lt(sserial, serial)) + serial = sserial; + } + ZONEDB_UNLOCK(&secure->dblock, isc_rwlocktype_read); } + if (secure != NULL) + UNLOCK_ZONE(secure); + UNLOCK_ZONE(zone); + /* * Note: we are task locked here so we can test * zone->xfr safely. @@ -10041,6 +10069,9 @@ notify_send(dns_notify_t *notify) { REQUIRE(DNS_NOTIFY_VALID(notify)); REQUIRE(LOCKED_ZONE(notify->zone)); + if (DNS_ZONE_FLAG(notify->zone, DNS_ZONEFLG_EXITING)) + return; + for (ai = ISC_LIST_HEAD(notify->find->list); ai != NULL; ai = ISC_LIST_NEXT(ai, publink)) { @@ -10116,7 +10147,8 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) { DNS_ZONE_TIME_ADD(now, zone->notifydelay, &zone->notifytime); UNLOCK_ZONE(zone); - if (! DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED)) + if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING) || + ! DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED)) return; if (notifytype == dns_notifytype_no) @@ -11644,9 +11676,6 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) { zone->irefs--; } - if (zone->view != NULL) - dns_view_weakdetach(&zone->view); - /* * We have now canceled everything set the flag to allow exit_check() * to succeed. We must not unlock between setting this flag and @@ -17428,7 +17457,7 @@ dns_zone_keydone(dns_zone_t *zone, const char *keystr) { kd->all = ISC_TRUE; else { isc_textregion_t r; - char *algstr; + const char *algstr; dns_keytag_t keyid; dns_secalg_t alg; size_t n; diff --git a/contrib/bind9/lib/export/dns/Makefile.in b/contrib/bind9/lib/export/dns/Makefile.in index f575f8673..033b021fa 100644 --- a/contrib/bind9/lib/export/dns/Makefile.in +++ b/contrib/bind9/lib/export/dns/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009-2013 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009-2013, 2015, 2016 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -22,7 +22,7 @@ export_srcdir = @top_srcdir@/lib/export .NOTPARALLEL: .NO_PARALLEL: -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @LIBDNS_API@ @@ -79,7 +79,7 @@ OPENSSLLINKSRCS = openssl_link.c openssldh_link.c openssldsa_link.c \ DSTSRCS = @OPENSSLLINKSRCS@ \ dst_api.c dst_lib.c dst_parse.c \ dst_result.c gssapi_link.c gssapictx.c \ - hmac_link.c key.c + hmac_link.c key.c DNSSRCS = acl.c adb.c byaddr.c \ cache.c callbacks.c client.c compress.c \ @@ -168,7 +168,8 @@ code.h: gen ./gen -s ${srcdir} > code.h gen: ${srcdir}/gen.c - ${CC} ${ALL_CFLAGS} ${LDFLAGS} -o $@ ${srcdir}/gen.c ${LIBS} + ${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \ + ${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS} #We don't need rbtdb64 for this library #rbtdb64.@O@: rbtdb.c diff --git a/contrib/bind9/lib/export/dns/include/dns/Makefile.in b/contrib/bind9/lib/export/dns/include/dns/Makefile.in index b7f51b4a3..29a740bd3 100644 --- a/contrib/bind9/lib/export/dns/include/dns/Makefile.in +++ b/contrib/bind9/lib/export/dns/include/dns/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -17,7 +17,7 @@ srcdir = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = acl.h adb.h byaddr.h \ cache.h callbacks.h cert.h client.h compress.h \ diff --git a/contrib/bind9/lib/export/dns/include/dst/Makefile.in b/contrib/bind9/lib/export/dns/include/dst/Makefile.in index f6f540a2e..a565db5b3 100644 --- a/contrib/bind9/lib/export/dns/include/dst/Makefile.in +++ b/contrib/bind9/lib/export/dns/include/dst/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -17,7 +17,7 @@ srcdir = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = dst.h gssapi.h lib.h result.h diff --git a/contrib/bind9/lib/export/irs/Makefile.in b/contrib/bind9/lib/export/irs/Makefile.in index b2520f9eb..0044c5c70 100644 --- a/contrib/bind9/lib/export/irs/Makefile.in +++ b/contrib/bind9/lib/export/irs/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2011-2013 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2011-2013, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ top_srcdir = @top_srcdir@ srcdir = @top_srcdir@/lib/irs export_srcdir = @top_srcdir@/lib/export -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @LIBIRS_API@ diff --git a/contrib/bind9/lib/export/irs/include/irs/Makefile.in b/contrib/bind9/lib/export/irs/include/irs/Makefile.in index 530e67c84..f31f4e4c7 100644 --- a/contrib/bind9/lib/export/irs/include/irs/Makefile.in +++ b/contrib/bind9/lib/export/irs/include/irs/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -12,8 +12,6 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.3 2009/09/02 23:48:02 tbox Exp $ - srcdir = @srcdir@ top_srcdir = @top_srcdir@ diff --git a/contrib/bind9/lib/export/isc/Makefile.in b/contrib/bind9/lib/export/isc/Makefile.in index c02ce9602..a15ea83d8 100644 --- a/contrib/bind9/lib/export/isc/Makefile.in +++ b/contrib/bind9/lib/export/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2010, 2012-2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2010, 2012-2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ top_srcdir = @top_srcdir@ srcdir = @top_srcdir@/lib/isc export_srcdir = @top_srcdir@/lib/export -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @LIBISC_API@ diff --git a/contrib/bind9/lib/export/isc/include/isc/Makefile.in b/contrib/bind9/lib/export/isc/include/isc/Makefile.in index 8c7eff8ef..2d4a1ecce 100644 --- a/contrib/bind9/lib/export/isc/include/isc/Makefile.in +++ b/contrib/bind9/lib/export/isc/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2012, 2013, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ srcdir = @srcdir@ top_srcdir = @top_srcdir@ export_srcdir = @top_srcdir@/lib/export -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ # # Only list headers that are to be installed and are not diff --git a/contrib/bind9/lib/export/isc/nothreads/include/isc/Makefile.in b/contrib/bind9/lib/export/isc/nothreads/include/isc/Makefile.in index 9bda987dd..e79943685 100644 --- a/contrib/bind9/lib/export/isc/nothreads/include/isc/Makefile.in +++ b/contrib/bind9/lib/export/isc/nothreads/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -17,7 +17,7 @@ srcdir = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = condition.h mutex.h once.h thread.h diff --git a/contrib/bind9/lib/export/isc/pthreads/include/isc/Makefile.in b/contrib/bind9/lib/export/isc/pthreads/include/isc/Makefile.in index 431976853..0ccf7be43 100644 --- a/contrib/bind9/lib/export/isc/pthreads/include/isc/Makefile.in +++ b/contrib/bind9/lib/export/isc/pthreads/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -17,7 +17,7 @@ srcdir = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = condition.h mutex.h once.h thread.h diff --git a/contrib/bind9/lib/export/isc/unix/include/isc/Makefile.in b/contrib/bind9/lib/export/isc/unix/include/isc/Makefile.in index ebbc97362..d40644ce1 100644 --- a/contrib/bind9/lib/export/isc/unix/include/isc/Makefile.in +++ b/contrib/bind9/lib/export/isc/unix/include/isc/Makefile.in @@ -17,7 +17,7 @@ srcdir = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = dir.h int.h net.h netdb.h offset.h stat.h stdtime.h \ syslog.h time.h diff --git a/contrib/bind9/lib/export/isccfg/Makefile.in b/contrib/bind9/lib/export/isccfg/Makefile.in index 2a791a4de..8626d0ba3 100644 --- a/contrib/bind9/lib/export/isccfg/Makefile.in +++ b/contrib/bind9/lib/export/isccfg/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2011-2013 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2011-2013, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ top_srcdir = @top_srcdir@ srcdir = @top_srcdir@/lib/isccfg export_srcdir = @top_srcdir@/lib/export -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @LIBISCCFG_API@ diff --git a/contrib/bind9/lib/export/isccfg/include/isccfg/Makefile.in b/contrib/bind9/lib/export/isccfg/include/isccfg/Makefile.in index 57a344cc2..d944f55e6 100644 --- a/contrib/bind9/lib/export/isccfg/include/isccfg/Makefile.in +++ b/contrib/bind9/lib/export/isccfg/include/isccfg/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -17,7 +17,7 @@ srcdir = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ # # Only list headers that are to be installed and are not diff --git a/contrib/bind9/lib/export/samples/Makefile.in b/contrib/bind9/lib/export/samples/Makefile.in index 194aaeb24..601ba77dd 100644 --- a/contrib/bind9/lib/export/samples/Makefile.in +++ b/contrib/bind9/lib/export/samples/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2012, 2013, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ srcdir = @srcdir@ top_srcdir = @top_srcdir@ export_srcdir = @top_srcdir@/lib/export -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @BIND9_MAKE_INCLUDES@ diff --git a/contrib/bind9/lib/irs/Makefile.in b/contrib/bind9/lib/irs/Makefile.in index ba802bf47..4028ff99c 100644 --- a/contrib/bind9/lib/irs/Makefile.in +++ b/contrib/bind9/lib/irs/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2009, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2009, 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @LIBIRS_API@ diff --git a/contrib/bind9/lib/irs/resconf.c b/contrib/bind9/lib/irs/resconf.c index cb2400795..de953ff62 100644 --- a/contrib/bind9/lib/irs/resconf.c +++ b/contrib/bind9/lib/irs/resconf.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2009, 2011, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2009, 2011, 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -170,11 +170,12 @@ eatwhite(FILE *fp) { static int getword(FILE *fp, char *buffer, size_t size) { int ch; - char *p = buffer; + char *p; REQUIRE(buffer != NULL); REQUIRE(size > 0U); + p = buffer; *p = '\0'; ch = eatwhite(fp); diff --git a/contrib/bind9/lib/isc/Makefile.in b/contrib/bind9/lib/isc/Makefile.in index 3176a2679..8b2c0608a 100644 --- a/contrib/bind9/lib/isc/Makefile.in +++ b/contrib/bind9/lib/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2003 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -17,7 +17,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @LIBISC_API@ diff --git a/contrib/bind9/lib/isc/alpha/include/isc/Makefile.in b/contrib/bind9/lib/isc/alpha/include/isc/Makefile.in index 4927e210f..df7561585 100644 --- a/contrib/bind9/lib/isc/alpha/include/isc/Makefile.in +++ b/contrib/bind9/lib/isc/alpha/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = atomic.h diff --git a/contrib/bind9/lib/isc/api b/contrib/bind9/lib/isc/api index 9a572b2d2..7de96ec52 100644 --- a/contrib/bind9/lib/isc/api +++ b/contrib/bind9/lib/isc/api @@ -4,6 +4,6 @@ # 9.8: 80-89, 120-129 # 9.9: 90-109 # 9.9-sub: 130-139 -LIBINTERFACE = 106 -LIBREVISION = 0 -LIBAGE = 0 +LIBINTERFACE = 107 +LIBREVISION = 1 +LIBAGE = 1 diff --git a/contrib/bind9/lib/isc/base32.c b/contrib/bind9/lib/isc/base32.c index 2ee99b182..e472439eb 100644 --- a/contrib/bind9/lib/isc/base32.c +++ b/contrib/bind9/lib/isc/base32.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2008, 2009, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2008, 2009, 2013-2015 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -170,7 +170,7 @@ base32_decode_init(base32_decode_ctx_t *ctx, int length, const char base[], static inline isc_result_t base32_decode_char(base32_decode_ctx_t *ctx, int c) { - char *s; + const char *s; unsigned int last; if (ctx->seen_end) diff --git a/contrib/bind9/lib/isc/base64.c b/contrib/bind9/lib/isc/base64.c index 6b4cb1bf7..554097c47 100644 --- a/contrib/bind9/lib/isc/base64.c +++ b/contrib/bind9/lib/isc/base64.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2013-2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -118,7 +118,7 @@ base64_decode_init(base64_decode_ctx_t *ctx, int length, isc_buffer_t *target) static inline isc_result_t base64_decode_char(base64_decode_ctx_t *ctx, int c) { - char *s; + const char *s; if (ctx->seen_end) return (ISC_R_BADBASE64); diff --git a/contrib/bind9/lib/isc/buffer.c b/contrib/bind9/lib/isc/buffer.c index 2d15e2485..d0f08d767 100644 --- a/contrib/bind9/lib/isc/buffer.c +++ b/contrib/bind9/lib/isc/buffer.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2008, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2008, 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -462,6 +462,8 @@ isc_buffer_allocate(isc_mem_t *mctx, isc_buffer_t **dynbuffer, length); dbuf->mctx = mctx; + ENSURE(ISC_BUFFER_VALID(dbuf)); + *dynbuffer = dbuf; return (ISC_R_SUCCESS); diff --git a/contrib/bind9/lib/isc/commandline.c b/contrib/bind9/lib/isc/commandline.c index 416fba192..e58b1b8ce 100644 --- a/contrib/bind9/lib/isc/commandline.c +++ b/contrib/bind9/lib/isc/commandline.c @@ -95,7 +95,7 @@ static char endopt = '\0'; int isc_commandline_parse(int argc, char * const *argv, const char *options) { static char *place = ENDOPT; - char *option; /* Index into *options of option. */ + const char *option; /* Index into *options of option. */ REQUIRE(argc >= 0 && argv != NULL && options != NULL); diff --git a/contrib/bind9/lib/isc/hash.c b/contrib/bind9/lib/isc/hash.c index 6ee8dcf5a..8fd585328 100644 --- a/contrib/bind9/lib/isc/hash.c +++ b/contrib/bind9/lib/isc/hash.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009, 2013-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -399,3 +399,152 @@ isc_hash_calc(const unsigned char *key, unsigned int keylen, return (hash_calc(hash, key, keylen, case_sensitive)); } + +static isc_uint32_t fnv_offset_basis; +static isc_once_t fnv_once = ISC_ONCE_INIT; + +static void +fnv_initialize(void) { + /* + * This function should not leave fnv_offset_basis set to + * 0. Also, after this function has been called, if it is called + * again, it should not change fnv_offset_basis. + */ + while (fnv_offset_basis == 0) { + isc_random_get(&fnv_offset_basis); + } +} + +isc_uint32_t +isc_hash_function(const void *data, size_t length, + isc_boolean_t case_sensitive, + const isc_uint32_t *previous_hashp) +{ + isc_uint32_t hval; + const unsigned char *bp; + const unsigned char *be; + + INSIST(data == NULL || length > 0); + RUNTIME_CHECK(isc_once_do(&fnv_once, fnv_initialize) == ISC_R_SUCCESS); + + hval = ISC_UNLIKELY(previous_hashp != NULL) ? + *previous_hashp : fnv_offset_basis; + + if (length == 0) + return (hval); + + bp = (const unsigned char *) data; + be = bp + length; + + /* + * Fowler-Noll-Vo FNV-1a hash function. + * + * NOTE: A random fnv_offset_basis is used by default to avoid + * collision attacks as the hash function is reversible. This + * makes the mapping non-deterministic, but the distribution in + * the domain is still uniform. + */ + + if (case_sensitive) { + while (bp < be - 4) { + hval ^= (isc_uint32_t) bp[0]; + hval *= 16777619; + hval ^= (isc_uint32_t) bp[1]; + hval *= 16777619; + hval ^= (isc_uint32_t) bp[2]; + hval *= 16777619; + hval ^= (isc_uint32_t) bp[3]; + hval *= 16777619; + bp += 4; + } + while (bp < be) { + hval ^= (isc_uint32_t) *bp++; + hval *= 16777619; + } + } else { + while (bp < be - 4) { + hval ^= (isc_uint32_t) maptolower[bp[0]]; + hval *= 16777619; + hval ^= (isc_uint32_t) maptolower[bp[1]]; + hval *= 16777619; + hval ^= (isc_uint32_t) maptolower[bp[2]]; + hval *= 16777619; + hval ^= (isc_uint32_t) maptolower[bp[3]]; + hval *= 16777619; + bp += 4; + } + while (bp < be) { + hval ^= (isc_uint32_t) maptolower[*bp++]; + hval *= 16777619; + } + } + + return (hval); +} + +isc_uint32_t +isc_hash_function_reverse(const void *data, size_t length, + isc_boolean_t case_sensitive, + const isc_uint32_t *previous_hashp) +{ + isc_uint32_t hval; + const unsigned char *bp; + const unsigned char *be; + + INSIST(data == NULL || length > 0); + RUNTIME_CHECK(isc_once_do(&fnv_once, fnv_initialize) == ISC_R_SUCCESS); + + hval = ISC_UNLIKELY(previous_hashp != NULL) ? + *previous_hashp : fnv_offset_basis; + + if (length == 0) + return (hval); + + bp = (const unsigned char *) data; + be = bp + length; + + /* + * Fowler-Noll-Vo FNV-1a hash function. + * + * NOTE: A random fnv_offset_basis is used by default to avoid + * collision attacks as the hash function is reversible. This + * makes the mapping non-deterministic, but the distribution in + * the domain is still uniform. + */ + + if (case_sensitive) { + while (be >= bp + 4) { + be -= 4; + hval ^= (isc_uint32_t) be[3]; + hval *= 16777619; + hval ^= (isc_uint32_t) be[2]; + hval *= 16777619; + hval ^= (isc_uint32_t) be[1]; + hval *= 16777619; + hval ^= (isc_uint32_t) be[0]; + hval *= 16777619; + } + while (--be >= bp) { + hval ^= (isc_uint32_t) *be; + hval *= 16777619; + } + } else { + while (be >= bp + 4) { + be -= 4; + hval ^= (isc_uint32_t) maptolower[be[3]]; + hval *= 16777619; + hval ^= (isc_uint32_t) maptolower[be[2]]; + hval *= 16777619; + hval ^= (isc_uint32_t) maptolower[be[1]]; + hval *= 16777619; + hval ^= (isc_uint32_t) maptolower[be[0]]; + hval *= 16777619; + } + while (--be >= bp) { + hval ^= (isc_uint32_t) maptolower[*be]; + hval *= 16777619; + } + } + + return (hval); +} diff --git a/contrib/bind9/lib/isc/hex.c b/contrib/bind9/lib/isc/hex.c index 00903c737..9e565c8a1 100644 --- a/contrib/bind9/lib/isc/hex.c +++ b/contrib/bind9/lib/isc/hex.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2008, 2013, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2008, 2013-2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -95,7 +95,7 @@ hex_decode_init(hex_decode_ctx_t *ctx, int length, isc_buffer_t *target) static inline isc_result_t hex_decode_char(hex_decode_ctx_t *ctx, int c) { - char *s; + const char *s; if ((s = strchr(hex, toupper(c))) == NULL) return (ISC_R_BADHEX); diff --git a/contrib/bind9/lib/isc/httpd.c b/contrib/bind9/lib/isc/httpd.c index 241c1d53a..b33f3577f 100644 --- a/contrib/bind9/lib/isc/httpd.c +++ b/contrib/bind9/lib/isc/httpd.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2006-2008, 2010-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2006-2008, 2010-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -360,6 +360,73 @@ httpdmgr_destroy(isc_httpdmgr_t *httpdmgr) { #define LENGTHOK(s) (httpd->recvbuf - (s) < (int)httpd->recvlen) #define BUFLENOK(s) (httpd->recvbuf - (s) < HTTP_RECVLEN) +/* + * Look for the given header in headers. + * If value is specified look for it terminated with a character in eov. + */ +static isc_boolean_t +have_header(isc_httpd_t *httpd, const char *header, const char *value, + const char *eov) +{ + char *cr, *nl, *h; + size_t hlen, vlen = 0; + + h = httpd->headers; + hlen = strlen(header); + if (value != NULL) { + INSIST(eov != NULL); + vlen = strlen(value); + } + + for (;;) { + if (strncasecmp(h, header, hlen) != 0) { + /* + * Skip to next line; + */ + cr = strchr(h, '\r'); + if (cr != NULL && cr[1] == '\n') + cr++; + nl = strchr(h, '\n'); + + /* last header? */ + h = cr; + if (h == NULL || (nl != NULL && nl < h)) + h = nl; + if (h == NULL) + return (ISC_FALSE); + h++; + continue; + } + + if (value == NULL) + return (ISC_TRUE); + + /* + * Skip optional leading white space. + */ + h += hlen; + while (*h == ' ' || *h == '\t') + h++; + /* + * Terminate token search on NULL or EOL. + */ + while (*h != 0 && *h != '\r' && *h != '\n') { + if (strncasecmp(h, value, vlen) == 0) + if (strchr(eov, h[vlen]) != NULL) + return (ISC_TRUE); + /* + * Skip to next token. + */ + h += strcspn(h, eov); + if (h[0] == '\r' && h[1] == '\n') + h++; + if (h[0] != 0) + h++; + } + return (ISC_FALSE); + } +} + static isc_result_t process_request(isc_httpd_t *httpd, int length) { char *s; @@ -378,14 +445,19 @@ process_request(isc_httpd_t *httpd, int length) { * more data. */ s = strstr(httpd->recvbuf, "\r\n\r\n"); - delim = 1; + delim = 2; if (s == NULL) { s = strstr(httpd->recvbuf, "\n\n"); - delim = 2; + delim = 1; } if (s == NULL) return (ISC_R_NOTFOUND); + /* + * NUL terminate request at the blank line. + */ + s[delim] = 0; + /* * Determine if this is a POST or GET method. Any other values will * cause an error to be returned. @@ -444,7 +516,7 @@ process_request(isc_httpd_t *httpd, int length) { } httpd->url = p; - p = s + delim; + p = s + 1; s = p; /* @@ -459,7 +531,7 @@ process_request(isc_httpd_t *httpd, int length) { /* * Extract the HTTP/1.X protocol. We will bounce on anything but - * HTTP/1.1 for now. + * HTTP/1.0 or HTTP/1.1 for now. */ while (LENGTHOK(s) && BUFLENOK(s) && (*s != '\n' && *s != '\r' && *s != '\0')) @@ -468,24 +540,30 @@ process_request(isc_httpd_t *httpd, int length) { return (ISC_R_NOTFOUND); if (!BUFLENOK(s)) return (ISC_R_NOMEMORY); + /* + * Check that we have the expected eol delimiter. + */ + if (strncmp(s, delim == 1 ? "\n" : "\r\n", delim) != 0) + return (ISC_R_RANGE); *s = 0; if ((strncmp(p, "HTTP/1.0", 8) != 0) && (strncmp(p, "HTTP/1.1", 8) != 0)) return (ISC_R_RANGE); httpd->protocol = p; - p = s + 1; + p = s + delim; /* skip past eol */ s = p; httpd->headers = s; - if (strstr(s, "Connection: close") != NULL) + if (have_header(httpd, "Connection:", "close", ", \t\r\n")) httpd->flags |= HTTPD_CLOSE; - if (strstr(s, "Host: ") != NULL) + if (have_header(httpd, "Host:", NULL, NULL)) httpd->flags |= HTTPD_FOUNDHOST; if (strncmp(httpd->protocol, "HTTP/1.0", 8) == 0) { - if (strcasestr(s, "Connection: Keep-Alive") != NULL) + if (have_header(httpd, "Connection:", "Keep-Alive", + ", \t\r\n")) httpd->flags |= HTTPD_KEEPALIVE; else httpd->flags |= HTTPD_CLOSE; @@ -838,7 +916,7 @@ isc_httpd_response(isc_httpd_t *httpd) { return (result); } - sprintf(isc_buffer_used(&httpd->headerbuffer), "%s %03d %s\r\n", + sprintf(isc_buffer_used(&httpd->headerbuffer), "%s %03u %s\r\n", httpd->protocol, httpd->retcode, httpd->retmsg); isc_buffer_add(&httpd->headerbuffer, needlen); diff --git a/contrib/bind9/lib/isc/ia64/include/isc/Makefile.in b/contrib/bind9/lib/isc/ia64/include/isc/Makefile.in index 4927e210f..df7561585 100644 --- a/contrib/bind9/lib/isc/ia64/include/isc/Makefile.in +++ b/contrib/bind9/lib/isc/ia64/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = atomic.h diff --git a/contrib/bind9/lib/isc/include/isc/Makefile.in b/contrib/bind9/lib/isc/include/isc/Makefile.in index 572bb3e10..15b55069b 100644 --- a/contrib/bind9/lib/isc/include/isc/Makefile.in +++ b/contrib/bind9/lib/isc/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004-2009, 2012-2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004-2009, 2012-2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2001, 2003 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -17,7 +17,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ # # Only list headers that are to be installed and are not diff --git a/contrib/bind9/lib/isc/include/isc/assertions.h b/contrib/bind9/lib/isc/include/isc/assertions.h index 2c81b1ae9..ebe96922d 100644 --- a/contrib/bind9/lib/isc/include/isc/assertions.h +++ b/contrib/bind9/lib/isc/include/isc/assertions.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1997-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -83,7 +83,7 @@ isc_assertion_typetotext(isc_assertiontype_t type); #if ISC_CHECK_REQUIRE != 0 #define ISC_REQUIRE(cond) \ - ((void) ((cond) || \ + ((void) (ISC_LIKELY(cond) || \ ((isc_assertion_failed)(__FILE__, __LINE__, \ isc_assertiontype_require, \ #cond), 0))) @@ -93,7 +93,7 @@ isc_assertion_typetotext(isc_assertiontype_t type); #if ISC_CHECK_ENSURE != 0 #define ISC_ENSURE(cond) \ - ((void) ((cond) || \ + ((void) (ISC_LIKELY(cond) || \ ((isc_assertion_failed)(__FILE__, __LINE__, \ isc_assertiontype_ensure, \ #cond), 0))) @@ -103,7 +103,7 @@ isc_assertion_typetotext(isc_assertiontype_t type); #if ISC_CHECK_INSIST != 0 #define ISC_INSIST(cond) \ - ((void) ((cond) || \ + ((void) (ISC_LIKELY(cond) || \ ((isc_assertion_failed)(__FILE__, __LINE__, \ isc_assertiontype_insist, \ #cond), 0))) @@ -113,7 +113,7 @@ isc_assertion_typetotext(isc_assertiontype_t type); #if ISC_CHECK_INVARIANT != 0 #define ISC_INVARIANT(cond) \ - ((void) ((cond) || \ + ((void) (ISC_LIKELY(cond) || \ ((isc_assertion_failed)(__FILE__, __LINE__, \ isc_assertiontype_invariant, \ #cond), 0))) diff --git a/contrib/bind9/lib/isc/include/isc/error.h b/contrib/bind9/lib/isc/include/isc/error.h index e0cdfa83e..b6cac178e 100644 --- a/contrib/bind9/lib/isc/include/isc/error.h +++ b/contrib/bind9/lib/isc/include/isc/error.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -55,7 +55,7 @@ void isc_error_runtimecheck(const char *, int, const char *); #define ISC_ERROR_RUNTIMECHECK(cond) \ - ((void) ((cond) || \ + ((void) (ISC_LIKELY(cond) || \ ((isc_error_runtimecheck)(__FILE__, __LINE__, #cond), 0))) ISC_LANG_ENDDECLS diff --git a/contrib/bind9/lib/isc/include/isc/file.h b/contrib/bind9/lib/isc/include/isc/file.h index 7137410b6..97e4fd323 100644 --- a/contrib/bind9/lib/isc/include/isc/file.h +++ b/contrib/bind9/lib/isc/include/isc/file.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009, 2011-2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2011-2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -312,8 +312,8 @@ isc_file_safecreate(const char *filename, FILE **fp); */ isc_result_t -isc_file_splitpath(isc_mem_t *mctx, char *path, - char **dirname, char **basename); +isc_file_splitpath(isc_mem_t *mctx, const char *path, + char **dirname, char const **basename); /*%< * Split a path into dirname and basename. If 'path' contains no slash * (or, on windows, backslash), then '*dirname' is set to ".". diff --git a/contrib/bind9/lib/isc/include/isc/hash.h b/contrib/bind9/lib/isc/include/isc/hash.h index 0bfe936d7..46cdf78b4 100644 --- a/contrib/bind9/lib/isc/include/isc/hash.h +++ b/contrib/bind9/lib/isc/include/isc/hash.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009, 2013 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2013, 2015, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -180,6 +180,45 @@ isc_hash_calc(const unsigned char *key, unsigned int keylen, */ /*@}*/ +isc_uint32_t +isc_hash_function(const void *data, size_t length, + isc_boolean_t case_sensitive, + const isc_uint32_t *previous_hashp); +isc_uint32_t +isc_hash_function_reverse(const void *data, size_t length, + isc_boolean_t case_sensitive, + const isc_uint32_t *previous_hashp); +/*!< + * \brief Calculate a hash over data. + * + * This hash function is useful for hashtables. The hash function is + * opaque and not important to the caller. The returned hash values are + * non-deterministic and will have different mapping every time a + * process using this library is run, but will have uniform + * distribution. + * + * isc_hash_function() calculates the hash from start to end over the + * input data. isc_hash_function_reverse() calculates the hash from the + * end to the start over the input data. The difference in order is + * useful in incremental hashing; for example, a previously hashed + * value for 'com' can be used as input when hashing 'example.com'. + * + * This is a new variant of isc_hash_calc() and will supercede + * isc_hash_calc() eventually. + * + * 'data' is the data to be hashed. + * + * 'length' is the size of the data to be hashed. + * + * 'case_sensitive' specifies whether the hash key should be treated as + * case_sensitive values. It should typically be ISC_FALSE if the hash key + * is a DNS name. + * + * 'previous_hashp' is a pointer to a previous hash value returned by + * this function. It can be used to perform incremental hashing. NULL + * must be passed during first calls. + */ + ISC_LANG_ENDDECLS #endif /* ISC_HASH_H */ diff --git a/contrib/bind9/lib/isc/include/isc/magic.h b/contrib/bind9/lib/isc/include/isc/magic.h index 073de90dc..679d9d923 100644 --- a/contrib/bind9/lib/isc/include/isc/magic.h +++ b/contrib/bind9/lib/isc/include/isc/magic.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -20,6 +20,8 @@ #ifndef ISC_MAGIC_H #define ISC_MAGIC_H 1 +#include + /*! \file isc/magic.h */ typedef struct { @@ -33,8 +35,8 @@ typedef struct { * The intent of this is to allow magic numbers to be checked even though * the object is otherwise opaque. */ -#define ISC_MAGIC_VALID(a,b) (((a) != NULL) && \ - (((const isc__magic_t *)(a))->magic == (b))) +#define ISC_MAGIC_VALID(a,b) (ISC_LIKELY((a) != NULL) && \ + ISC_LIKELY(((const isc__magic_t *)(a))->magic == (b))) #define ISC_MAGIC(a, b, c, d) ((a) << 24 | (b) << 16 | (c) << 8 | (d)) diff --git a/contrib/bind9/lib/isc/include/isc/netaddr.h b/contrib/bind9/lib/isc/include/isc/netaddr.h index 954d77019..140d11826 100644 --- a/contrib/bind9/lib/isc/include/isc/netaddr.h +++ b/contrib/bind9/lib/isc/include/isc/netaddr.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -155,6 +155,12 @@ isc_netaddr_issitelocal(isc_netaddr_t *na); * Returns #ISC_TRUE if the address is a site local address. */ +isc_boolean_t +isc_netaddr_isnetzero(isc_netaddr_t *na); +/*%< + * Returns #ISC_TRUE if the address is in net zero. + */ + void isc_netaddr_fromv4mapped(isc_netaddr_t *t, const isc_netaddr_t *s); /*%< diff --git a/contrib/bind9/lib/isc/include/isc/platform.h.in b/contrib/bind9/lib/isc/include/isc/platform.h.in index 667a1454a..ae2af287c 100644 --- a/contrib/bind9/lib/isc/include/isc/platform.h.in +++ b/contrib/bind9/lib/isc/include/isc/platform.h.in @@ -288,11 +288,17 @@ @ISC_PLATFORM_HAVEXADDQ@ /* - * If the "atomic swap" operation is available on this architecture, - * ISC_PLATFORM_HAVEATOMICSTORE" will be defined. + * If the 32-bit "atomic swap" operation is available on this + * architecture, ISC_PLATFORM_HAVEATOMICSTORE" will be defined. */ @ISC_PLATFORM_HAVEATOMICSTORE@ +/* + * If the 64-bit "atomic swap" operation is available on this + * architecture, ISC_PLATFORM_HAVEATOMICSTORE" will be defined. + */ +@ISC_PLATFORM_HAVEATOMICSTOREQ@ + /* * If the "compare-and-exchange" operation is available on this architecture, * ISC_PLATFORM_HAVECMPXCHG will be defined. diff --git a/contrib/bind9/lib/isc/include/isc/result.h b/contrib/bind9/lib/isc/include/isc/result.h index ed1bc63e7..ce881e1a2 100644 --- a/contrib/bind9/lib/isc/include/isc/result.h +++ b/contrib/bind9/lib/isc/include/isc/result.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -89,9 +89,10 @@ #define ISC_R_BADBASE32 60 /*%< bad base32 encoding */ #define ISC_R_UNSET 61 /*%< unset */ #define ISC_R_MULTIPLE 62 /*%< multiple */ +#define ISC_R_WOULDBLOCK 63 /*%< would block */ /*% Not a result code: the number of results. */ -#define ISC_R_NRESULTS 63 +#define ISC_R_NRESULTS 64 ISC_LANG_BEGINDECLS diff --git a/contrib/bind9/lib/isc/include/isc/sockaddr.h b/contrib/bind9/lib/isc/include/isc/sockaddr.h index 4d811dd64..5dfc3d23f 100644 --- a/contrib/bind9/lib/isc/include/isc/sockaddr.h +++ b/contrib/bind9/lib/isc/include/isc/sockaddr.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2009, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -220,6 +220,12 @@ isc_sockaddr_issitelocal(const isc_sockaddr_t *sa); * Returns ISC_TRUE if the address is a sitelocal address. */ +isc_boolean_t +isc_sockaddr_isnetzero(const isc_sockaddr_t *sa); +/*%< + * Returns ISC_TRUE if the address is in net zero. + */ + isc_result_t isc_sockaddr_frompath(isc_sockaddr_t *sockaddr, const char *path); /* diff --git a/contrib/bind9/lib/isc/include/isc/socket.h b/contrib/bind9/lib/isc/include/isc/socket.h index 97e2f7605..0ee305c89 100644 --- a/contrib/bind9/lib/isc/include/isc/socket.h +++ b/contrib/bind9/lib/isc/include/isc/socket.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2009, 2011-2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2009, 2011-2014, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -370,7 +370,8 @@ isc_socket_fdwatchcreate(isc_socketmgr_t *manager, * * Note: * - *\li 'fd' is the already-opened file descriptor. + *\li 'fd' is the already-opened file descriptor (must be less + * than maxsockets). *\li This function is not available on Windows. *\li The callback function is called "in-line" - this means the function * needs to return as fast as possible, as all other I/O will be suspended @@ -394,6 +395,7 @@ isc_socket_fdwatchcreate(isc_socketmgr_t *manager, *\li #ISC_R_NOMEMORY *\li #ISC_R_NORESOURCES *\li #ISC_R_UNEXPECTED + *\li #ISC_R_RANGE */ isc_result_t diff --git a/contrib/bind9/lib/isc/include/isc/util.h b/contrib/bind9/lib/isc/include/isc/util.h index 6baf786bd..fc2e18826 100644 --- a/contrib/bind9/lib/isc/include/isc/util.h +++ b/contrib/bind9/lib/isc/include/isc/util.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2010-2012, 2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2010-2012, 2015, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -206,6 +206,17 @@ #define INSERTAFTER(li, a, e, ln) ISC_LIST_INSERTAFTER(li, a, e, ln) #define APPENDLIST(list1, list2, link) ISC_LIST_APPENDLIST(list1, list2, link) +/*% + * Performance + */ +#ifdef HAVE_BUILTIN_EXPECT +#define ISC_LIKELY(x) __builtin_expect(!!(x), 1) +#define ISC_UNLIKELY(x) __builtin_expect(!!(x), 0) +#else +#define ISC_LIKELY(x) (x) +#define ISC_UNLIKELY(x) (x) +#endif + /* * Assertions */ diff --git a/contrib/bind9/lib/isc/md5.c b/contrib/bind9/lib/isc/md5.c index 579d61c20..55d56195f 100644 --- a/contrib/bind9/lib/isc/md5.c +++ b/contrib/bind9/lib/isc/md5.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2009, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2000, 2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -57,6 +57,8 @@ isc_md5_invalidate(isc_md5_t *ctx) { void isc_md5_update(isc_md5_t *ctx, const unsigned char *buf, unsigned int len) { + if (len == 0U) + return; RUNTIME_CHECK(EVP_DigestUpdate(ctx, (const void *) buf, (size_t) len) == 1); diff --git a/contrib/bind9/lib/isc/mem.c b/contrib/bind9/lib/isc/mem.c index 854425750..dfa5e5727 100644 --- a/contrib/bind9/lib/isc/mem.c +++ b/contrib/bind9/lib/isc/mem.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2010, 2012-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2010, 2012-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1997-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -1987,53 +1987,43 @@ isc___mempool_get(isc_mempool_t *mpctx0 FLARG) { /* * Don't let the caller go over quota */ - if (mpctx->allocated >= mpctx->maxalloc) { + if (ISC_UNLIKELY(mpctx->allocated >= mpctx->maxalloc)) { item = NULL; goto out; } - /* - * if we have a free list item, return the first here - */ - item = mpctx->items; - if (item != NULL) { - mpctx->items = item->next; - INSIST(mpctx->freecount > 0); - mpctx->freecount--; - mpctx->gets++; - mpctx->allocated++; - goto out; - } - - /* - * We need to dip into the well. Lock the memory context here and - * fill up our free list. - */ - MCTXLOCK(mctx, &mctx->lock); - for (i = 0; i < mpctx->fillcount; i++) { - if ((mctx->flags & ISC_MEMFLAG_INTERNAL) != 0) { - item = mem_getunlocked(mctx, mpctx->size); - } else { - item = mem_get(mctx, mpctx->size); - if (item != NULL) - mem_getstats(mctx, mpctx->size); + if (ISC_UNLIKELY(mpctx->items == NULL)) { + /* + * We need to dip into the well. Lock the memory context + * here and fill up our free list. + */ + MCTXLOCK(mctx, &mctx->lock); + for (i = 0; i < mpctx->fillcount; i++) { + if ((mctx->flags & ISC_MEMFLAG_INTERNAL) != 0) { + item = mem_getunlocked(mctx, mpctx->size); + } else { + item = mem_get(mctx, mpctx->size); + if (item != NULL) + mem_getstats(mctx, mpctx->size); + } + if (ISC_UNLIKELY(item == NULL)) + break; + item->next = mpctx->items; + mpctx->items = item; + mpctx->freecount++; } - if (item == NULL) - break; - item->next = mpctx->items; - mpctx->items = item; - mpctx->freecount++; + MCTXUNLOCK(mctx, &mctx->lock); } - MCTXUNLOCK(mctx, &mctx->lock); /* * If we didn't get any items, return NULL. */ item = mpctx->items; - if (item == NULL) + if (ISC_UNLIKELY(item == NULL)) goto out; mpctx->items = item->next; + INSIST(mpctx->freecount > 0); mpctx->freecount--; mpctx->gets++; mpctx->allocated++; diff --git a/contrib/bind9/lib/isc/mips/include/isc/Makefile.in b/contrib/bind9/lib/isc/mips/include/isc/Makefile.in index 4927e210f..df7561585 100644 --- a/contrib/bind9/lib/isc/mips/include/isc/Makefile.in +++ b/contrib/bind9/lib/isc/mips/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = atomic.h diff --git a/contrib/bind9/lib/isc/netaddr.c b/contrib/bind9/lib/isc/netaddr.c index dcbfba42e..2178c7a2a 100644 --- a/contrib/bind9/lib/isc/netaddr.c +++ b/contrib/bind9/lib/isc/netaddr.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2005, 2007, 2010-2012, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2010-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -419,6 +419,22 @@ isc_netaddr_issitelocal(isc_netaddr_t *na) { } } +#ifndef IN_ZERONET +#define IN_ZERONET(x) (((x) & htonl(0xff000000U)) == 0) +#endif + +isc_boolean_t +isc_netaddr_isnetzero(isc_netaddr_t *na) { + switch (na->family) { + case AF_INET: + return (ISC_TF(IN_ZERONET(na->type.in.s_addr))); + case AF_INET6: + return (ISC_FALSE); + default: + return (ISC_FALSE); + } +} + void isc_netaddr_fromv4mapped(isc_netaddr_t *t, const isc_netaddr_t *s) { isc_netaddr_t *src; diff --git a/contrib/bind9/lib/isc/noatomic/include/isc/Makefile.in b/contrib/bind9/lib/isc/noatomic/include/isc/Makefile.in index 4927e210f..df7561585 100644 --- a/contrib/bind9/lib/isc/noatomic/include/isc/Makefile.in +++ b/contrib/bind9/lib/isc/noatomic/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = atomic.h diff --git a/contrib/bind9/lib/isc/nothreads/include/isc/Makefile.in b/contrib/bind9/lib/isc/nothreads/include/isc/Makefile.in index a2c347eaa..f32180f3a 100644 --- a/contrib/bind9/lib/isc/nothreads/include/isc/Makefile.in +++ b/contrib/bind9/lib/isc/nothreads/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000, 2001 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = condition.h mutex.h once.h thread.h diff --git a/contrib/bind9/lib/isc/powerpc/include/isc/Makefile.in b/contrib/bind9/lib/isc/powerpc/include/isc/Makefile.in index 4927e210f..df7561585 100644 --- a/contrib/bind9/lib/isc/powerpc/include/isc/Makefile.in +++ b/contrib/bind9/lib/isc/powerpc/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = atomic.h diff --git a/contrib/bind9/lib/isc/pthreads/include/isc/Makefile.in b/contrib/bind9/lib/isc/pthreads/include/isc/Makefile.in index 7cadcf4b6..68e6c76b8 100644 --- a/contrib/bind9/lib/isc/pthreads/include/isc/Makefile.in +++ b/contrib/bind9/lib/isc/pthreads/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2001 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = condition.h mutex.h once.h thread.h diff --git a/contrib/bind9/lib/isc/result.c b/contrib/bind9/lib/isc/result.c index 6cbd8b472..27927e8f2 100644 --- a/contrib/bind9/lib/isc/result.c +++ b/contrib/bind9/lib/isc/result.c @@ -104,6 +104,7 @@ static const char *description[ISC_R_NRESULTS] = { "bad base32 encoding", /*%< 60 */ "unset", /*%< 61 */ "multiple", /*%< 62 */ + "would block", /*%< 63 */ }; #define ISC_RESULT_RESULTSET 2 diff --git a/contrib/bind9/lib/isc/sockaddr.c b/contrib/bind9/lib/isc/sockaddr.c index cee6d700c..195f1c1c7 100644 --- a/contrib/bind9/lib/isc/sockaddr.c +++ b/contrib/bind9/lib/isc/sockaddr.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2010-2012, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2010-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -205,7 +205,6 @@ isc_sockaddr_hash(const isc_sockaddr_t *sockaddr, isc_boolean_t address_only) { unsigned int length = 0; const unsigned char *s = NULL; unsigned int h = 0; - unsigned int g; unsigned int p = 0; const struct in6_addr *in6; @@ -239,12 +238,9 @@ isc_sockaddr_hash(const isc_sockaddr_t *sockaddr, isc_boolean_t address_only) { p = 0; } - h = isc_hash_calc(s, length, ISC_TRUE); - if (!address_only) { - g = isc_hash_calc((const unsigned char *)&p, sizeof(p), - ISC_TRUE); - h = h ^ g; /* XXX: we should concatenate h and p first */ - } + h = isc_hash_function(s, length, ISC_TRUE, NULL); + if (!address_only) + h = isc_hash_function(&p, sizeof(p), ISC_TRUE, &h); return (h); } @@ -368,7 +364,7 @@ isc_sockaddr_pf(const isc_sockaddr_t *sockaddr) { void isc_sockaddr_fromnetaddr(isc_sockaddr_t *sockaddr, const isc_netaddr_t *na, - in_port_t port) + in_port_t port) { memset(sockaddr, 0, sizeof(*sockaddr)); sockaddr->type.sin.sin_family = na->family; @@ -483,6 +479,17 @@ isc_sockaddr_islinklocal(const isc_sockaddr_t *sockaddr) { return (ISC_FALSE); } +isc_boolean_t +isc_sockaddr_isnetzero(const isc_sockaddr_t *sockaddr) { + isc_netaddr_t netaddr; + + if (sockaddr->type.sa.sa_family == AF_INET) { + isc_netaddr_fromsockaddr(&netaddr, sockaddr); + return (isc_netaddr_isnetzero(&netaddr)); + } + return (ISC_FALSE); +} + isc_result_t isc_sockaddr_frompath(isc_sockaddr_t *sockaddr, const char *path) { #ifdef ISC_PLATFORM_HAVESYSUNH diff --git a/contrib/bind9/lib/isc/sparc64/include/isc/Makefile.in b/contrib/bind9/lib/isc/sparc64/include/isc/Makefile.in index 4927e210f..df7561585 100644 --- a/contrib/bind9/lib/isc/sparc64/include/isc/Makefile.in +++ b/contrib/bind9/lib/isc/sparc64/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = atomic.h diff --git a/contrib/bind9/lib/isc/stats.c b/contrib/bind9/lib/isc/stats.c index 03d2a8a7d..368dadfc3 100644 --- a/contrib/bind9/lib/isc/stats.c +++ b/contrib/bind9/lib/isc/stats.c @@ -35,13 +35,45 @@ #define ISC_STATS_MAGIC ISC_MAGIC('S', 't', 'a', 't') #define ISC_STATS_VALID(x) ISC_MAGIC_VALID(x, ISC_STATS_MAGIC) -#ifndef ISC_STATS_USEMULTIFIELDS -#if defined(ISC_RWLOCK_USEATOMIC) && defined(ISC_PLATFORM_HAVEXADD) && !defined(ISC_PLATFORM_HAVEXADDQ) +/*% + * Local macro confirming prescence of 64-bit + * increment and store operations, just to make + * the later macros simpler + */ +#if defined(ISC_PLATFORM_HAVEXADDQ) && defined(ISC_PLATFORM_HAVEATOMICSTOREQ) +#define ISC_STATS_HAVEATOMICQ 1 +#else +#define ISC_STATS_HAVEATOMICQ 0 +#endif + +/*% + * Only lock the counters if 64-bit atomic operations are + * not available but cheap atomic lock operations are. + * On a modern 64-bit system this should never be the case. + * + * Normal locks are too expensive to be used whenever a counter + * is updated. + */ +#if !ISC_STATS_HAVEATOMICQ && defined(ISC_RWLOCK_HAVEATOMIC) +#define ISC_STATS_LOCKCOUNTERS 1 +#else +#define ISC_STATS_LOCKCOUNTERS 0 +#endif + +/*% + * If 64-bit atomic operations are not available but + * 32-bit operations are then split the counter into two, + * using the atomic operations to try to ensure that any carry + * from the low word is correctly carried into the high word. + * + * Otherwise, just rely on standard 64-bit data types + * and operations + */ +#if !ISC_STATS_HAVEATOMICQ && defined(ISC_PLATFORM_HAVEXADD) #define ISC_STATS_USEMULTIFIELDS 1 #else #define ISC_STATS_USEMULTIFIELDS 0 #endif -#endif /* ISC_STATS_USEMULTIFIELDS */ #if ISC_STATS_USEMULTIFIELDS typedef struct { @@ -65,7 +97,7 @@ struct isc_stats { * Locked by counterlock or unlocked if efficient rwlock is not * available. */ -#ifdef ISC_RWLOCK_USEATOMIC +#if ISC_STATS_LOCKCOUNTERS isc_rwlock_t counterlock; #endif isc_stat_t *counters; @@ -111,7 +143,7 @@ create_stats(isc_mem_t *mctx, int ncounters, isc_stats_t **statsp) { goto clean_counters; } -#ifdef ISC_RWLOCK_USEATOMIC +#if ISC_STATS_LOCKCOUNTERS result = isc_rwlock_init(&stats->counterlock, 0, 0); if (result != ISC_R_SUCCESS) goto clean_copiedcounters; @@ -131,7 +163,7 @@ create_stats(isc_mem_t *mctx, int ncounters, isc_stats_t **statsp) { clean_counters: isc_mem_put(mctx, stats->counters, sizeof(isc_stat_t) * ncounters); -#ifdef ISC_RWLOCK_USEATOMIC +#if ISC_STATS_LOCKCOUNTERS clean_copiedcounters: isc_mem_put(mctx, stats->copiedcounters, sizeof(isc_stat_t) * ncounters); @@ -177,7 +209,7 @@ isc_stats_detach(isc_stats_t **statsp) { sizeof(isc_stat_t) * stats->ncounters); UNLOCK(&stats->lock); DESTROYLOCK(&stats->lock); -#ifdef ISC_RWLOCK_USEATOMIC +#if ISC_STATS_LOCKCOUNTERS isc_rwlock_destroy(&stats->counterlock); #endif isc_mem_putanddetach(&stats->mctx, stats, sizeof(*stats)); @@ -198,7 +230,7 @@ static inline void incrementcounter(isc_stats_t *stats, int counter) { isc_int32_t prev; -#ifdef ISC_RWLOCK_USEATOMIC +#if ISC_STATS_LOCKCOUNTERS /* * We use a "read" lock to prevent other threads from reading the * counter while we "writing" a counter field. The write access itself @@ -219,7 +251,7 @@ incrementcounter(isc_stats_t *stats, int counter) { */ if (prev == (isc_int32_t)0xffffffff) isc_atomic_xadd((isc_int32_t *)&stats->counters[counter].hi, 1); -#elif defined(ISC_PLATFORM_HAVEXADDQ) +#elif ISC_STATS_HAVEATOMICQ UNUSED(prev); isc_atomic_xaddq((isc_int64_t *)&stats->counters[counter], 1); #else @@ -227,7 +259,7 @@ incrementcounter(isc_stats_t *stats, int counter) { stats->counters[counter]++; #endif -#ifdef ISC_RWLOCK_USEATOMIC +#if ISC_STATS_LOCKCOUNTERS isc_rwlock_unlock(&stats->counterlock, isc_rwlocktype_read); #endif } @@ -236,7 +268,7 @@ static inline void decrementcounter(isc_stats_t *stats, int counter) { isc_int32_t prev; -#ifdef ISC_RWLOCK_USEATOMIC +#if ISC_STATS_LOCKCOUNTERS isc_rwlock_lock(&stats->counterlock, isc_rwlocktype_read); #endif @@ -245,7 +277,7 @@ decrementcounter(isc_stats_t *stats, int counter) { if (prev == 0) isc_atomic_xadd((isc_int32_t *)&stats->counters[counter].hi, -1); -#elif defined(ISC_PLATFORM_HAVEXADDQ) +#elif ISC_STATS_HAVEATOMICQ UNUSED(prev); isc_atomic_xaddq((isc_int64_t *)&stats->counters[counter], -1); #else @@ -253,7 +285,7 @@ decrementcounter(isc_stats_t *stats, int counter) { stats->counters[counter]--; #endif -#ifdef ISC_RWLOCK_USEATOMIC +#if ISC_STATS_LOCKCOUNTERS isc_rwlock_unlock(&stats->counterlock, isc_rwlocktype_read); #endif } @@ -262,7 +294,7 @@ static void copy_counters(isc_stats_t *stats) { int i; -#ifdef ISC_RWLOCK_USEATOMIC +#if ISC_STATS_LOCKCOUNTERS /* * We use a "write" lock before "reading" the statistics counters as * an exclusive lock. @@ -270,19 +302,21 @@ copy_counters(isc_stats_t *stats) { isc_rwlock_lock(&stats->counterlock, isc_rwlocktype_write); #endif -#if ISC_STATS_USEMULTIFIELDS for (i = 0; i < stats->ncounters; i++) { +#if ISC_STATS_USEMULTIFIELDS stats->copiedcounters[i] = - (isc_uint64_t)(stats->counters[i].hi) << 32 | - stats->counters[i].lo; - } + (isc_uint64_t)(stats->counters[i].hi) << 32 | + stats->counters[i].lo; +#elif ISC_STATS_HAVEATOMICQ + /* use xaddq(..., 0) as an atomic load */ + stats->copiedcounters[i] = + (isc_uint64_t)isc_atomic_xaddq((isc_int64_t *)&stats->counters[i], 0); #else - UNUSED(i); - memmove(stats->copiedcounters, stats->counters, - stats->ncounters * sizeof(isc_stat_t)); + stats->copiedcounters[i] = stats->counters[i]; #endif + } -#ifdef ISC_RWLOCK_USEATOMIC +#if ISC_STATS_LOCKCOUNTERS isc_rwlock_unlock(&stats->counterlock, isc_rwlocktype_write); #endif } diff --git a/contrib/bind9/lib/isc/string.c b/contrib/bind9/lib/isc/string.c index 56ec444bf..04a259437 100644 --- a/contrib/bind9/lib/isc/string.c +++ b/contrib/bind9/lib/isc/string.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2007, 2011, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2007, 2011, 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001, 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -56,14 +56,14 @@ #include #include -static char digits[] = "0123456789abcdefghijklmnoprstuvwxyz"; +static const char digits[] = "0123456789abcdefghijklmnoprstuvwxyz"; isc_uint64_t isc_string_touint64(char *source, char **end, int base) { isc_uint64_t tmp; isc_uint64_t overflow; char *s = source; - char *o; + const char *o; char c; if ((base < 0) || (base == 1) || (base > 36)) { diff --git a/contrib/bind9/lib/isc/task.c b/contrib/bind9/lib/isc/task.c index 3503801e4..81785e9a8 100644 --- a/contrib/bind9/lib/isc/task.c +++ b/contrib/bind9/lib/isc/task.c @@ -15,8 +15,6 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id$ */ - /*! \file * \author Principal Author: Bob Halley */ @@ -1638,11 +1636,11 @@ isc__taskmgr_dispatch(isc_taskmgr_t *manager0) { ISC_TASKFUNC_SCOPE void isc__taskmgr_pause(isc_taskmgr_t *manager0) { isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0; + manager->pause_requested = ISC_TRUE; LOCK(&manager->lock); while (manager->tasks_running > 0) { WAIT(&manager->paused, &manager->lock); } - manager->pause_requested = ISC_TRUE; UNLOCK(&manager->lock); } diff --git a/contrib/bind9/lib/isc/unix/file.c b/contrib/bind9/lib/isc/unix/file.c index c2abd440e..3fc2a2912 100644 --- a/contrib/bind9/lib/isc/unix/file.c +++ b/contrib/bind9/lib/isc/unix/file.c @@ -204,8 +204,9 @@ isc_file_mktemplate(const char *path, char *buf, size_t buflen) { isc_result_t isc_file_template(const char *path, const char *templet, char *buf, - size_t buflen) { - char *s; + size_t buflen) +{ + const char *s; REQUIRE(path != NULL); REQUIRE(templet != NULL); @@ -262,7 +263,7 @@ isc_file_renameunique(const char *file, char *templet) { if (errno != EEXIST) return (isc__errno2result(errno)); for (cp = x;;) { - char *t; + const char *t; if (*cp == '\0') return (ISC_R_FAILURE); t = strchr(alphnum, *cp); @@ -461,7 +462,7 @@ isc_file_ischdiridempotent(const char *filename) { const char * isc_file_basename(const char *filename) { - char *s; + const char *s; REQUIRE(filename != NULL); @@ -579,9 +580,11 @@ isc_file_safecreate(const char *filename, FILE **fp) { } isc_result_t -isc_file_splitpath(isc_mem_t *mctx, char *path, char **dirname, char **basename) +isc_file_splitpath(isc_mem_t *mctx, const char *path, char **dirname, + char const **basename) { - char *dir, *file, *slash; + char *dir; + const char *file, *slash; if (path == NULL) return (ISC_R_INVALIDFILE); diff --git a/contrib/bind9/lib/isc/unix/include/isc/Makefile.in b/contrib/bind9/lib/isc/unix/include/isc/Makefile.in index 9cd96d71b..f37036ac1 100644 --- a/contrib/bind9/lib/isc/unix/include/isc/Makefile.in +++ b/contrib/bind9/lib/isc/unix/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2007, 2012-2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007, 2012-2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2001 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = dir.h int.h keyboard.h net.h netdb.h offset.h stat.h \ stdtime.h strerror.h syslog.h time.h diff --git a/contrib/bind9/lib/isc/unix/net.c b/contrib/bind9/lib/isc/unix/net.c index c811d1ba4..7ed73aad5 100644 --- a/contrib/bind9/lib/isc/unix/net.c +++ b/contrib/bind9/lib/isc/unix/net.c @@ -103,10 +103,10 @@ const struct in6_addr isc_net_in6addrloop = IN6ADDR_LOOPBACK_INIT; # if defined(WANT_IPV6) static isc_once_t once_ipv6only = ISC_ONCE_INIT; -# endif -# if defined(ISC_PLATFORM_HAVEIN6PKTINFO) +# if defined(ISC_PLATFORM_HAVEIN6PKTINFO) static isc_once_t once_ipv6pktinfo = ISC_ONCE_INIT; +# endif # endif #endif /* ISC_PLATFORM_HAVEIPV6 */ diff --git a/contrib/bind9/lib/isc/unix/socket.c b/contrib/bind9/lib/isc/unix/socket.c index 5e6320d82..42fc47f6d 100644 --- a/contrib/bind9/lib/isc/unix/socket.c +++ b/contrib/bind9/lib/isc/unix/socket.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -394,6 +394,9 @@ struct isc__socketmgr { /* Locked by fdlock. */ isc__socket_t **fds; int *fdstate; +#if defined(USE_EPOLL) + uint32_t *epoll_events; +#endif #ifdef USE_DEVPOLL pollinfo_t *fdpollinfo; #endif @@ -835,15 +838,27 @@ watch_fd(isc__socketmgr_t *manager, int fd, int msg) { return (result); #elif defined(USE_EPOLL) struct epoll_event event; + uint32_t oldevents; + int ret; + int op; + oldevents = manager->epoll_events[fd]; if (msg == SELECT_POKE_READ) - event.events = EPOLLIN; + manager->epoll_events[fd] |= EPOLLIN; else - event.events = EPOLLOUT; + manager->epoll_events[fd] |= EPOLLOUT; + + event.events = manager->epoll_events[fd]; memset(&event.data, 0, sizeof(event.data)); event.data.fd = fd; - if (epoll_ctl(manager->epoll_fd, EPOLL_CTL_ADD, fd, &event) == -1 && - errno != EEXIST) { + + op = (oldevents == 0U) ? EPOLL_CTL_ADD : EPOLL_CTL_MOD; + ret = epoll_ctl(manager->epoll_fd, op, fd, &event); + if (ret == -1) { + if (errno == EEXIST) + UNEXPECTED_ERROR(__FILE__, __LINE__, + "epoll_ctl(ADD/MOD) returned " + "EEXIST for fd %d", fd); result = isc__errno2result(errno); } @@ -903,15 +918,21 @@ unwatch_fd(isc__socketmgr_t *manager, int fd, int msg) { return (result); #elif defined(USE_EPOLL) struct epoll_event event; + int ret; + int op; if (msg == SELECT_POKE_READ) - event.events = EPOLLIN; + manager->epoll_events[fd] &= ~(EPOLLIN); else - event.events = EPOLLOUT; + manager->epoll_events[fd] &= ~(EPOLLOUT); + + event.events = manager->epoll_events[fd]; memset(&event.data, 0, sizeof(event.data)); event.data.fd = fd; - if (epoll_ctl(manager->epoll_fd, EPOLL_CTL_DEL, fd, &event) == -1 && - errno != ENOENT) { + + op = (event.events == 0U) ? EPOLL_CTL_DEL : EPOLL_CTL_MOD; + ret = epoll_ctl(manager->epoll_fd, op, fd, &event); + if (ret == -1 && errno != ENOENT) { char strbuf[ISC_STRERRORSIZE]; isc__strerror(errno, strbuf, sizeof(strbuf)); UNEXPECTED_ERROR(__FILE__, __LINE__, @@ -1553,15 +1574,19 @@ build_msghdr_recv(isc__socket_t *sock, isc_socketevent_t *dev, msg->msg_iovlen = iovcount; #ifdef ISC_NET_BSD44MSGHDR - msg->msg_control = NULL; - msg->msg_controllen = 0; - msg->msg_flags = 0; #if defined(USE_CMSG) if (sock->type == isc_sockettype_udp) { msg->msg_control = sock->recvcmsgbuf; msg->msg_controllen = sock->recvcmsgbuflen; + } else { + msg->msg_control = NULL; + msg->msg_controllen = 0; } +#else + msg->msg_control = NULL; + msg->msg_controllen = 0; #endif /* USE_CMSG */ + msg->msg_flags = 0; #else /* ISC_NET_BSD44MSGHDR */ msg->msg_accrights = NULL; msg->msg_accrightslen = 0; @@ -1872,8 +1897,11 @@ doio_send(isc__socket_t *sock, isc_socketevent_t *dev) { if (send_errno == EINTR && ++attempts < NRETRIES) goto resend; - if (SOFT_ERROR(send_errno)) + if (SOFT_ERROR(send_errno)) { + if (errno == EWOULDBLOCK || errno == EAGAIN) + dev->result = ISC_R_WOULDBLOCK; return (DOIO_SOFT); + } #define SOFT_OR_HARD(_system, _isc) \ if (send_errno == _system) { \ @@ -2035,7 +2063,7 @@ destroy(isc__socket_t **sockp) { INSIST(ISC_LIST_EMPTY(sock->recv_list)); INSIST(ISC_LIST_EMPTY(sock->send_list)); INSIST(sock->connect_ev == NULL); - REQUIRE(sock->fd == -1 || sock->fd < (int)manager->maxsocks); + INSIST(sock->fd >= -1 && sock->fd < (int)manager->maxsocks); if (sock->fd >= 0) { fd = sock->fd; @@ -2192,8 +2220,8 @@ static void free_socket(isc__socket_t **socketp) { isc__socket_t *sock = *socketp; - INSIST(sock->references == 0); INSIST(VALID_SOCKET(sock)); + INSIST(sock->references == 0); INSIST(!sock->connecting); INSIST(!sock->pending_recv); INSIST(!sock->pending_send); @@ -2633,6 +2661,9 @@ socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type, LOCK(&manager->fdlock[lockid]); manager->fds[sock->fd] = sock; manager->fdstate[sock->fd] = MANAGED; +#if defined(USE_EPOLL) + manager->epoll_events[sock->fd] = 0; +#endif #ifdef USE_DEVPOLL INSIST(sock->manager->fdpollinfo[sock->fd].want_read == 0 && sock->manager->fdpollinfo[sock->fd].want_write == 0); @@ -2710,6 +2741,9 @@ isc__socket_open(isc_socket_t *sock0) { LOCK(&sock->manager->fdlock[lockid]); sock->manager->fds[sock->fd] = sock; sock->manager->fdstate[sock->fd] = MANAGED; +#if defined(USE_EPOLL) + sock->manager->epoll_events[sock->fd] = 0; +#endif #ifdef USE_DEVPOLL INSIST(sock->manager->fdpollinfo[sock->fd].want_read == 0 && sock->manager->fdpollinfo[sock->fd].want_write == 0); @@ -2747,6 +2781,9 @@ isc__socket_fdwatchcreate(isc_socketmgr_t *manager0, int fd, int flags, REQUIRE(VALID_MANAGER(manager)); REQUIRE(socketp != NULL && *socketp == NULL); + if (fd < 0 || (unsigned int)fd >= manager->maxsocks) + return (ISC_R_RANGE); + result = allocate_socket(manager, isc_sockettype_fdwatch, &sock); if (result != ISC_R_SUCCESS) return (result); @@ -2771,6 +2808,9 @@ isc__socket_fdwatchcreate(isc_socketmgr_t *manager0, int fd, int flags, LOCK(&manager->fdlock[lockid]); manager->fds[sock->fd] = sock; manager->fdstate[sock->fd] = MANAGED; +#if defined(USE_EPOLL) + manager->epoll_events[sock->fd] = 0; +#endif UNLOCK(&manager->fdlock[lockid]); LOCK(&manager->lock); @@ -3310,6 +3350,9 @@ internal_accept(isc_task_t *me, isc_event_t *ev) { LOCK(&manager->fdlock[lockid]); manager->fds[fd] = NEWCONNSOCK(dev); manager->fdstate[fd] = MANAGED; +#if defined(USE_EPOLL) + manager->epoll_events[fd] = 0; +#endif UNLOCK(&manager->fdlock[lockid]); LOCK(&manager->lock); @@ -4260,6 +4303,15 @@ isc__socketmgr_create2(isc_mem_t *mctx, isc_socketmgr_t **managerp, result = ISC_R_NOMEMORY; goto free_manager; } +#if defined(USE_EPOLL) + manager->epoll_events = isc_mem_get(mctx, (manager->maxsocks * + sizeof(uint32_t))); + if (manager->epoll_events == NULL) { + result = ISC_R_NOMEMORY; + goto free_manager; + } + memset(manager->epoll_events, 0, manager->maxsocks * sizeof(uint32_t)); +#endif manager->stats = NULL; manager->common.methods = &socketmgrmethods; @@ -4329,7 +4381,9 @@ isc__socketmgr_create2(isc_mem_t *mctx, isc_socketmgr_t **managerp, result = setup_watcher(mctx, manager); if (result != ISC_R_SUCCESS) goto cleanup; + memset(manager->fdstate, 0, manager->maxsocks * sizeof(int)); + #ifdef USE_WATCHER_THREAD /* * Start up the select/poll thread. @@ -4378,6 +4432,12 @@ free_manager: isc_mem_put(mctx, manager->fdlock, FDLOCK_COUNT * sizeof(isc_mutex_t)); } +#if defined(USE_EPOLL) + if (manager->epoll_events != NULL) { + isc_mem_put(mctx, manager->epoll_events, + manager->maxsocks * sizeof(uint32_t)); + } +#endif if (manager->fdstate != NULL) { isc_mem_put(mctx, manager->fdstate, manager->maxsocks * sizeof(int)); @@ -4493,6 +4553,10 @@ isc__socketmgr_destroy(isc_socketmgr_t **managerp) { if (manager->fdstate[i] == CLOSE_PENDING) /* no need to lock */ (void)close(i); +#if defined(USE_EPOLL) + isc_mem_put(manager->mctx, manager->epoll_events, + manager->maxsocks * sizeof(uint32_t)); +#endif isc_mem_put(manager->mctx, manager->fds, manager->maxsocks * sizeof(isc__socket_t *)); isc_mem_put(manager->mctx, manager->fdstate, diff --git a/contrib/bind9/lib/isc/x86_32/include/isc/Makefile.in b/contrib/bind9/lib/isc/x86_32/include/isc/Makefile.in index 4927e210f..df7561585 100644 --- a/contrib/bind9/lib/isc/x86_32/include/isc/Makefile.in +++ b/contrib/bind9/lib/isc/x86_32/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = atomic.h diff --git a/contrib/bind9/lib/isc/x86_32/include/isc/atomic.h b/contrib/bind9/lib/isc/x86_32/include/isc/atomic.h index bf2148cb3..36088e4d5 100644 --- a/contrib/bind9/lib/isc/x86_32/include/isc/atomic.h +++ b/contrib/bind9/lib/isc/x86_32/include/isc/atomic.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2005, 2007, 2008, 2015 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -62,7 +62,7 @@ isc_atomic_xaddq(isc_int64_t *p, isc_int64_t val) { #endif /* ISC_PLATFORM_HAVEXADDQ */ /* - * This routine atomically stores the value 'val' in 'p'. + * This routine atomically stores the value 'val' in 'p' (32-bit version). */ static __inline__ void isc_atomic_store(isc_int32_t *p, isc_int32_t val) { @@ -81,6 +81,28 @@ isc_atomic_store(isc_int32_t *p, isc_int32_t val) { : "memory"); } +#ifdef ISC_PLATFORM_HAVEATOMICSTOREQ +/* + * This routine atomically stores the value 'val' in 'p' (64-bit version). + */ +static __inline__ void +isc_atomic_storeq(isc_int64_t *p, isc_int64_t val) { + __asm__ volatile( +#ifdef ISC_PLATFORM_USETHREADS + /* + * xchg should automatically lock memory, but we add it + * explicitly just in case (it at least doesn't harm) + */ + "lock;" +#endif + + "xchgq %1, %0" + : + : "r"(val), "m"(*p) + : "memory"); +} +#endif /* ISC_PLATFORM_HAVEATOMICSTOREQ */ + /* * This routine atomically replaces the value in 'p' with 'val', if the * original value is equal to 'cmpval'. The original value is returned in any diff --git a/contrib/bind9/lib/isc/x86_64/include/isc/Makefile.in b/contrib/bind9/lib/isc/x86_64/include/isc/Makefile.in index 9a988bb76..74b7f95cf 100644 --- a/contrib/bind9/lib/isc/x86_64/include/isc/Makefile.in +++ b/contrib/bind9/lib/isc/x86_64/include/isc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # # Permission to use, copy, modify, and/or distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -18,7 +18,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ HEADERS = atomic.h diff --git a/contrib/bind9/lib/isc/x86_64/include/isc/atomic.h b/contrib/bind9/lib/isc/x86_64/include/isc/atomic.h index f57bd2a78..431600b73 100644 --- a/contrib/bind9/lib/isc/x86_64/include/isc/atomic.h +++ b/contrib/bind9/lib/isc/x86_64/include/isc/atomic.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2005, 2007, 2008, 2015, 2016 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -87,12 +87,26 @@ isc_atomic_store(isc_int32_t *p, isc_int32_t val) { "lock;" #endif "xchgl (%rax), %edx\n" - /* - * XXX: assume %rax will be used as the return value. - */ ); } +#ifdef ISC_PLATFORM_HAVEATOMICSTOREQ +static void +isc_atomic_storeq(isc_int64_t *p, isc_int64_t val) { + UNUSED(p); + UNUSED(val); + + __asm ( + "movq %rdi, %rax\n" + "movq %rsi, %rdx\n" +#ifdef ISC_PLATFORM_USETHREADS + "lock;" +#endif + "xchgq (%rax), %rdx\n" + ); +} +#endif + static isc_int32_t isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) { UNUSED(p); @@ -100,6 +114,9 @@ isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) { UNUSED(val); __asm ( + /* + * p is %rdi, cmpval is %esi, val is %edx. + */ "movl %edx, %ecx\n" "movl %esi, %eax\n" "movq %rdi, %rdx\n" @@ -108,8 +125,12 @@ isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) { "lock;" #endif /* - * If (%rdi) == %eax then (%rdi) := %edx. - * %eax is set to old (%ecx), which will be the return value. + * If [%rdi] == %eax then [%rdi] := %ecx (equal to %edx + * from above), and %eax is untouched (equal to %esi) + * from above. + * + * Else if [%rdi] != %eax then [%rdi] := [%rdi] + * (rewritten in write cycle) and %eax := [%rdi]. */ "cmpxchgl %ecx, (%rdx)" ); diff --git a/contrib/bind9/lib/isccc/Makefile.in b/contrib/bind9/lib/isccc/Makefile.in index 843e510a6..b9561fbf7 100644 --- a/contrib/bind9/lib/isccc/Makefile.in +++ b/contrib/bind9/lib/isccc/Makefile.in @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @LIBISCCC_API@ diff --git a/contrib/bind9/lib/isccc/cc.c b/contrib/bind9/lib/isccc/cc.c index f98b72ae6..88a723128 100644 --- a/contrib/bind9/lib/isccc/cc.c +++ b/contrib/bind9/lib/isccc/cc.c @@ -29,8 +29,6 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: cc.c,v 1.18 2007/08/28 07:20:43 tbox Exp $ */ - /*! \file */ #include @@ -85,8 +83,7 @@ static isc_result_t list_towire(isccc_sexpr_t *alist, isccc_region_t *target); static isc_result_t -value_towire(isccc_sexpr_t *elt, isccc_region_t *target) -{ +value_towire(isccc_sexpr_t *elt, isccc_region_t *target) { unsigned int len; unsigned char *lenp; isccc_region_t *vr; @@ -328,8 +325,7 @@ static isc_result_t list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp); static isc_result_t -value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) -{ +value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) { unsigned int msgtype; isc_uint32_t len; isccc_sexpr_t *value; @@ -423,8 +419,7 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret, } static isc_result_t -list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp) -{ +list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp) { isccc_sexpr_t *list, *value; isc_result_t result; @@ -439,7 +434,7 @@ list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp) if (isccc_sexpr_addtolist(&list, value) == NULL) { isccc_sexpr_free(&value); isccc_sexpr_free(&list); - return (result); + return (ISC_R_NOMEMORY); } } @@ -585,8 +580,7 @@ isccc_cc_createack(isccc_sexpr_t *message, isc_boolean_t ok, } isc_boolean_t -isccc_cc_isack(isccc_sexpr_t *message) -{ +isccc_cc_isack(isccc_sexpr_t *message) { isccc_sexpr_t *_ctrl; _ctrl = isccc_alist_lookup(message, "_ctrl"); @@ -598,8 +592,7 @@ isccc_cc_isack(isccc_sexpr_t *message) } isc_boolean_t -isccc_cc_isreply(isccc_sexpr_t *message) -{ +isccc_cc_isreply(isccc_sexpr_t *message) { isccc_sexpr_t *_ctrl; _ctrl = isccc_alist_lookup(message, "_ctrl"); @@ -672,8 +665,7 @@ isccc_cc_createresponse(isccc_sexpr_t *message, isccc_time_t now, } isccc_sexpr_t * -isccc_cc_definestring(isccc_sexpr_t *alist, const char *key, const char *str) -{ +isccc_cc_definestring(isccc_sexpr_t *alist, const char *key, const char *str) { size_t len; isccc_region_t r; @@ -685,8 +677,7 @@ isccc_cc_definestring(isccc_sexpr_t *alist, const char *key, const char *str) } isccc_sexpr_t * -isccc_cc_defineuint32(isccc_sexpr_t *alist, const char *key, isc_uint32_t i) -{ +isccc_cc_defineuint32(isccc_sexpr_t *alist, const char *key, isc_uint32_t i) { char b[100]; size_t len; isccc_region_t r; @@ -700,8 +691,7 @@ isccc_cc_defineuint32(isccc_sexpr_t *alist, const char *key, isc_uint32_t i) } isc_result_t -isccc_cc_lookupstring(isccc_sexpr_t *alist, const char *key, char **strp) -{ +isccc_cc_lookupstring(isccc_sexpr_t *alist, const char *key, char **strp) { isccc_sexpr_t *kv, *v; REQUIRE(strp == NULL || *strp == NULL); @@ -754,9 +744,7 @@ symtab_undefine(char *key, unsigned int type, isccc_symvalue_t value, } static isc_boolean_t -symtab_clean(char *key, unsigned int type, isccc_symvalue_t value, - void *arg) -{ +symtab_clean(char *key, unsigned int type, isccc_symvalue_t value, void *arg) { isccc_time_t *now; UNUSED(key); @@ -772,21 +760,18 @@ symtab_clean(char *key, unsigned int type, isccc_symvalue_t value, } isc_result_t -isccc_cc_createsymtab(isccc_symtab_t **symtabp) -{ +isccc_cc_createsymtab(isccc_symtab_t **symtabp) { return (isccc_symtab_create(11897, symtab_undefine, NULL, ISC_FALSE, symtabp)); } void -isccc_cc_cleansymtab(isccc_symtab_t *symtab, isccc_time_t now) -{ +isccc_cc_cleansymtab(isccc_symtab_t *symtab, isccc_time_t now) { isccc_symtab_foreach(symtab, symtab_clean, &now); } static isc_boolean_t -has_whitespace(const char *str) -{ +has_whitespace(const char *str) { char c; if (str == NULL) diff --git a/contrib/bind9/lib/isccc/include/isccc/Makefile.in b/contrib/bind9/lib/isccc/include/isccc/Makefile.in index c4af19a74..98a99616e 100644 --- a/contrib/bind9/lib/isccc/include/isccc/Makefile.in +++ b/contrib/bind9/lib/isccc/include/isccc/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ # # Only list headers that are to be installed and are not diff --git a/contrib/bind9/lib/isccc/sexpr.c b/contrib/bind9/lib/isccc/sexpr.c index 9b7d5d7f3..adf27bde7 100644 --- a/contrib/bind9/lib/isccc/sexpr.c +++ b/contrib/bind9/lib/isccc/sexpr.c @@ -29,8 +29,6 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: sexpr.c,v 1.9 2007/08/28 07:20:43 tbox Exp $ */ - /*! \file */ #include @@ -50,8 +48,7 @@ static isccc_sexpr_t sexpr_t = { ISCCC_SEXPRTYPE_T, { NULL } }; #define CDR(s) (s)->value.as_dottedpair.cdr isccc_sexpr_t * -isccc_sexpr_cons(isccc_sexpr_t *car, isccc_sexpr_t *cdr) -{ +isccc_sexpr_cons(isccc_sexpr_t *car, isccc_sexpr_t *cdr) { isccc_sexpr_t *sexpr; sexpr = malloc(sizeof(*sexpr)); @@ -65,14 +62,12 @@ isccc_sexpr_cons(isccc_sexpr_t *car, isccc_sexpr_t *cdr) } isccc_sexpr_t * -isccc_sexpr_tconst(void) -{ +isccc_sexpr_tconst(void) { return (&sexpr_t); } isccc_sexpr_t * -isccc_sexpr_fromstring(const char *str) -{ +isccc_sexpr_fromstring(const char *str) { isccc_sexpr_t *sexpr; sexpr = malloc(sizeof(*sexpr)); @@ -89,8 +84,7 @@ isccc_sexpr_fromstring(const char *str) } isccc_sexpr_t * -isccc_sexpr_frombinary(const isccc_region_t *region) -{ +isccc_sexpr_frombinary(const isccc_region_t *region) { isccc_sexpr_t *sexpr; unsigned int region_size; @@ -123,8 +117,7 @@ isccc_sexpr_frombinary(const isccc_region_t *region) } void -isccc_sexpr_free(isccc_sexpr_t **sexprp) -{ +isccc_sexpr_free(isccc_sexpr_t **sexprp) { isccc_sexpr_t *sexpr; isccc_sexpr_t *item; @@ -153,8 +146,7 @@ isccc_sexpr_free(isccc_sexpr_t **sexprp) } static isc_boolean_t -printable(isccc_region_t *r) -{ +printable(isccc_region_t *r) { unsigned char *curr; curr = r->rstart; @@ -168,8 +160,7 @@ printable(isccc_region_t *r) } void -isccc_sexpr_print(isccc_sexpr_t *sexpr, FILE *stream) -{ +isccc_sexpr_print(isccc_sexpr_t *sexpr, FILE *stream) { isccc_sexpr_t *cdr; unsigned int size, i; unsigned char *curr; @@ -220,40 +211,35 @@ isccc_sexpr_print(isccc_sexpr_t *sexpr, FILE *stream) } isccc_sexpr_t * -isccc_sexpr_car(isccc_sexpr_t *list) -{ +isccc_sexpr_car(isccc_sexpr_t *list) { REQUIRE(list->type == ISCCC_SEXPRTYPE_DOTTEDPAIR); return (CAR(list)); } isccc_sexpr_t * -isccc_sexpr_cdr(isccc_sexpr_t *list) -{ +isccc_sexpr_cdr(isccc_sexpr_t *list) { REQUIRE(list->type == ISCCC_SEXPRTYPE_DOTTEDPAIR); return (CDR(list)); } void -isccc_sexpr_setcar(isccc_sexpr_t *pair, isccc_sexpr_t *car) -{ +isccc_sexpr_setcar(isccc_sexpr_t *pair, isccc_sexpr_t *car) { REQUIRE(pair->type == ISCCC_SEXPRTYPE_DOTTEDPAIR); CAR(pair) = car; } void -isccc_sexpr_setcdr(isccc_sexpr_t *pair, isccc_sexpr_t *cdr) -{ +isccc_sexpr_setcdr(isccc_sexpr_t *pair, isccc_sexpr_t *cdr) { REQUIRE(pair->type == ISCCC_SEXPRTYPE_DOTTEDPAIR); CDR(pair) = cdr; } isccc_sexpr_t * -isccc_sexpr_addtolist(isccc_sexpr_t **l1p, isccc_sexpr_t *l2) -{ +isccc_sexpr_addtolist(isccc_sexpr_t **l1p, isccc_sexpr_t *l2) { isccc_sexpr_t *last, *elt, *l1; REQUIRE(l1p != NULL); @@ -275,40 +261,35 @@ isccc_sexpr_addtolist(isccc_sexpr_t **l1p, isccc_sexpr_t *l2) } isc_boolean_t -isccc_sexpr_listp(isccc_sexpr_t *sexpr) -{ +isccc_sexpr_listp(isccc_sexpr_t *sexpr) { if (sexpr == NULL || sexpr->type == ISCCC_SEXPRTYPE_DOTTEDPAIR) return (ISC_TRUE); return (ISC_FALSE); } isc_boolean_t -isccc_sexpr_emptyp(isccc_sexpr_t *sexpr) -{ +isccc_sexpr_emptyp(isccc_sexpr_t *sexpr) { if (sexpr == NULL) return (ISC_TRUE); return (ISC_FALSE); } isc_boolean_t -isccc_sexpr_stringp(isccc_sexpr_t *sexpr) -{ +isccc_sexpr_stringp(isccc_sexpr_t *sexpr) { if (sexpr != NULL && sexpr->type == ISCCC_SEXPRTYPE_STRING) return (ISC_TRUE); return (ISC_FALSE); } isc_boolean_t -isccc_sexpr_binaryp(isccc_sexpr_t *sexpr) -{ +isccc_sexpr_binaryp(isccc_sexpr_t *sexpr) { if (sexpr != NULL && sexpr->type == ISCCC_SEXPRTYPE_BINARY) return (ISC_TRUE); return (ISC_FALSE); } char * -isccc_sexpr_tostring(isccc_sexpr_t *sexpr) -{ +isccc_sexpr_tostring(isccc_sexpr_t *sexpr) { REQUIRE(sexpr != NULL && (sexpr->type == ISCCC_SEXPRTYPE_STRING || sexpr->type == ISCCC_SEXPRTYPE_BINARY)); @@ -319,8 +300,7 @@ isccc_sexpr_tostring(isccc_sexpr_t *sexpr) } isccc_region_t * -isccc_sexpr_tobinary(isccc_sexpr_t *sexpr) -{ +isccc_sexpr_tobinary(isccc_sexpr_t *sexpr) { REQUIRE(sexpr != NULL && sexpr->type == ISCCC_SEXPRTYPE_BINARY); return (&sexpr->value.as_region); } diff --git a/contrib/bind9/lib/isccfg/Makefile.in b/contrib/bind9/lib/isccfg/Makefile.in index 6e07da3dc..db4577bfb 100644 --- a/contrib/bind9/lib/isccfg/Makefile.in +++ b/contrib/bind9/lib/isccfg/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2005, 2007, 2009, 2011, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2005, 2007, 2009, 2011, 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001-2003 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @LIBISCCFG_API@ diff --git a/contrib/bind9/lib/isccfg/aclconf.c b/contrib/bind9/lib/isccfg/aclconf.c index e1b689717..38fef0f57 100644 --- a/contrib/bind9/lib/isccfg/aclconf.c +++ b/contrib/bind9/lib/isccfg/aclconf.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004-2012, 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004-2012, 2014, 2016 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2002 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -254,10 +254,11 @@ count_acl_elements(const cfg_obj_t *caml, const cfg_obj_t *cctx, } else if (cfg_obj_isstring(ce)) { const char *name = cfg_obj_asstring(ce); if (strcasecmp(name, "localhost") == 0 || - strcasecmp(name, "localnets") == 0) { + strcasecmp(name, "localnets") == 0 || + strcasecmp(name, "none") == 0) + { n++; - } else if (strcasecmp(name, "any") != 0 && - strcasecmp(name, "none") != 0) { + } else if (strcasecmp(name, "any") != 0) { dns_acl_t *inneracl = NULL; /* * Convert any named acls we reference now if diff --git a/contrib/bind9/lib/isccfg/api b/contrib/bind9/lib/isccfg/api index bb8c0f039..6bcfb1bc3 100644 --- a/contrib/bind9/lib/isccfg/api +++ b/contrib/bind9/lib/isccfg/api @@ -5,5 +5,5 @@ # 9.9: 90-109 # 9.9-sub: 130-139 LIBINTERFACE = 93 -LIBREVISION = 0 +LIBREVISION = 1 LIBAGE = 3 diff --git a/contrib/bind9/lib/isccfg/include/isccfg/Makefile.in b/contrib/bind9/lib/isccfg/include/isccfg/Makefile.in index d6f395ca7..84911c6f1 100644 --- a/contrib/bind9/lib/isccfg/include/isccfg/Makefile.in +++ b/contrib/bind9/lib/isccfg/include/isccfg/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2005, 2007, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2005, 2007, 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001, 2002 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ # # Only list headers that are to be installed and are not diff --git a/contrib/bind9/lib/isccfg/namedconf.c b/contrib/bind9/lib/isccfg/namedconf.c index 0787ec5e0..d95a03a61 100644 --- a/contrib/bind9/lib/isccfg/namedconf.c +++ b/contrib/bind9/lib/isccfg/namedconf.c @@ -53,7 +53,8 @@ parse_enum_or_other(cfg_parser_t *pctx, const cfg_type_t *enumtype, const cfg_type_t *othertype, cfg_obj_t **ret); static void -doc_enum_or_other(cfg_printer_t *pctx, const cfg_type_t *type); +doc_enum_or_other(cfg_printer_t *pctx, const cfg_type_t *enumtype, + const cfg_type_t *othertype); static isc_result_t parse_keyvalue(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret); @@ -553,8 +554,12 @@ static isc_result_t parse_zonestat(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) { return (parse_enum_or_other(pctx, type, &cfg_type_boolean, ret)); } +static void +doc_zonestat(cfg_printer_t *pctx, const cfg_type_t *type) { + doc_enum_or_other(pctx, type, &cfg_type_boolean); +} static cfg_type_t cfg_type_zonestat = { - "zonestat", parse_zonestat, cfg_print_ustring, doc_enum_or_other, + "zonestat", parse_zonestat, cfg_print_ustring, doc_zonestat, &cfg_rep_string, zonestat_enums }; @@ -769,13 +774,18 @@ static cfg_type_t cfg_type_serverid = { /*% * Port list. */ +static void +print_porttuple(cfg_printer_t *pctx, const cfg_obj_t *obj) { + cfg_print_cstr(pctx, "range "); + cfg_print_tuple(pctx, obj); +} static cfg_tuplefielddef_t porttuple_fields[] = { { "loport", &cfg_type_uint32, 0 }, { "hiport", &cfg_type_uint32, 0 }, { NULL, NULL, 0 } }; static cfg_type_t cfg_type_porttuple = { - "porttuple", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, + "porttuple", cfg_parse_tuple, print_porttuple, cfg_doc_tuple, &cfg_rep_tuple, porttuple_fields }; @@ -845,7 +855,6 @@ static cfg_type_t cfg_type_bracketed_portlist = { &cfg_rep_list, &cfg_type_portrange }; -#ifdef ENABLE_FETCHLIMIT /*% * fetch-quota-params */ @@ -876,8 +885,7 @@ parse_optional_response(cfg_parser_t *pctx, const cfg_type_t *type, static void doc_optional_response(cfg_printer_t *pctx, const cfg_type_t *type) { - UNUSED(type); - cfg_print_cstr(pctx, "[ ( drop | fail ) ]"); + doc_enum_or_other(pctx, type, &cfg_type_void); } static cfg_type_t cfg_type_responsetype = { @@ -895,7 +903,6 @@ static cfg_type_t cfg_type_fetchesper = { "fetchesper", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple, fetchesper_fields }; -#endif /* ENABLE_FETCHLIMIT */ /*% * Clauses that can be found within the top level of the named.conf @@ -1001,7 +1008,7 @@ options_clauses[] = { { "transfers-out", &cfg_type_uint32, 0 }, { "treat-cr-as-space", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE }, { "use-id-pool", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE }, - { "use-ixfr", &cfg_type_boolean, 0 }, + { "use-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE }, { "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 }, { "use-v6-udp-ports", &cfg_type_bracketed_portlist, 0 }, { "version", &cfg_type_qstringornone, 0 }, @@ -1443,6 +1450,10 @@ view_clauses[] = { { "fetch-quota-params", &cfg_type_fetchquota, 0 }, { "fetches-per-server", &cfg_type_fetchesper, 0 }, { "fetches-per-zone", &cfg_type_fetchesper, 0 }, +#else + { "fetch-quota-params", &cfg_type_fetchquota, CFG_CLAUSEFLAG_NOTCONFIGURED }, + { "fetches-per-server", &cfg_type_fetchesper, CFG_CLAUSEFLAG_NOTCONFIGURED }, + { "fetches-per-zone", &cfg_type_fetchesper, CFG_CLAUSEFLAG_NOTCONFIGURED }, #endif /* ENABLE_FETCHLIMIT */ { "ixfr-from-differences", &cfg_type_ixfrdifftype, 0 }, { "lame-ttl", &cfg_type_uint32, 0 }, @@ -1964,9 +1975,14 @@ parse_size(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) { return (parse_enum_or_other(pctx, type, &cfg_type_sizeval, ret)); } +static void +doc_size(cfg_printer_t *pctx, const cfg_type_t *type) { + doc_enum_or_other(pctx, type, &cfg_type_sizeval); +} + static const char *size_enums[] = { "unlimited", "default", NULL }; static cfg_type_t cfg_type_size = { - "size", parse_size, cfg_print_ustring, cfg_doc_terminal, + "size", parse_size, cfg_print_ustring, doc_size, &cfg_rep_string, size_enums }; @@ -2028,12 +2044,34 @@ parse_enum_or_other(cfg_parser_t *pctx, const cfg_type_t *enumtype, } static void -doc_enum_or_other(cfg_printer_t *pctx, const cfg_type_t *type) { - cfg_doc_terminal(pctx, type); -#if 0 /* XXX */ - cfg_print_chars(pctx, "( ", 2);... -#endif +doc_enum_or_other(cfg_printer_t *pctx, const cfg_type_t *enumtype, + const cfg_type_t *othertype) +{ + const char * const *p; + isc_boolean_t first = ISC_TRUE; + /* + * If othertype is cfg_type_void, it means that enumtype is + * optional. + */ + + if (othertype == &cfg_type_void) + cfg_print_cstr(pctx, "[ "); + cfg_print_cstr(pctx, "( "); + for (p = enumtype->of; *p != NULL; p++) { + if (!first) + cfg_print_cstr(pctx, " | "); + first = ISC_FALSE; + cfg_print_cstr(pctx, *p); + } + if (othertype != &cfg_type_void) { + if (!first) + cfg_print_cstr(pctx, " | "); + cfg_doc_terminal(pctx, othertype); + } + cfg_print_cstr(pctx, " )"); + if (othertype == &cfg_type_void) + cfg_print_cstr(pctx, " ]"); } static isc_result_t @@ -2078,8 +2116,12 @@ static isc_result_t parse_dialup_type(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) { return (parse_enum_or_other(pctx, type, &cfg_type_boolean, ret)); } +static void +doc_dialup_type(cfg_printer_t *pctx, const cfg_type_t *type) { + doc_enum_or_other(pctx, type, &cfg_type_boolean); +} static cfg_type_t cfg_type_dialuptype = { - "dialuptype", parse_dialup_type, cfg_print_ustring, doc_enum_or_other, + "dialuptype", parse_dialup_type, cfg_print_ustring, doc_dialup_type, &cfg_rep_string, dialup_enums }; @@ -2088,18 +2130,28 @@ static isc_result_t parse_notify_type(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) { return (parse_enum_or_other(pctx, type, &cfg_type_boolean, ret)); } +static void +doc_notify_type(cfg_printer_t *pctx, const cfg_type_t *type) { + doc_enum_or_other(pctx, type, &cfg_type_boolean); +} static cfg_type_t cfg_type_notifytype = { - "notifytype", parse_notify_type, cfg_print_ustring, doc_enum_or_other, + "notifytype", parse_notify_type, cfg_print_ustring, doc_notify_type, &cfg_rep_string, notify_enums, }; static const char *ixfrdiff_enums[] = { "master", "slave", NULL }; static isc_result_t -parse_ixfrdiff_type(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) { +parse_ixfrdiff_type(cfg_parser_t *pctx, const cfg_type_t *type, + cfg_obj_t **ret) +{ return (parse_enum_or_other(pctx, type, &cfg_type_boolean, ret)); } +static void +doc_ixfrdiff_type(cfg_printer_t *pctx, const cfg_type_t *type) { + doc_enum_or_other(pctx, type, &cfg_type_boolean); +} static cfg_type_t cfg_type_ixfrdifftype = { - "ixfrdiff", parse_ixfrdiff_type, cfg_print_ustring, doc_enum_or_other, + "ixfrdiff", parse_ixfrdiff_type, cfg_print_ustring, doc_ixfrdiff_type, &cfg_rep_string, ixfrdiff_enums, }; @@ -2109,9 +2161,13 @@ parse_v4_aaaa(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) { return (parse_enum_or_other(pctx, type, &cfg_type_boolean, ret)); } +static void +doc_v4_aaaa(cfg_printer_t *pctx, const cfg_type_t *type) { + doc_enum_or_other(pctx, type, &cfg_type_boolean); +} static cfg_type_t cfg_type_v4_aaaa = { "v4_aaaa", parse_v4_aaaa, cfg_print_ustring, - doc_enum_or_other, &cfg_rep_string, v4_aaaa_enums, + doc_v4_aaaa, &cfg_rep_string, v4_aaaa_enums, }; static keyword_type_t key_kw = { "key", &cfg_type_astring }; @@ -2281,8 +2337,14 @@ parse_optional_class(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret return (result); } +static void +doc_optional_class(cfg_printer_t *pctx, const cfg_type_t *type) { + UNUSED(type); + cfg_print_cstr(pctx, "[ ]"); +} + static cfg_type_t cfg_type_optional_class = { - "optional_class", parse_optional_class, NULL, cfg_doc_terminal, + "optional_class", parse_optional_class, NULL, doc_optional_class, NULL, NULL }; @@ -2531,9 +2593,15 @@ parse_optional_facility(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t ** return (result); } +static void +doc_optional_facility(cfg_printer_t *pctx, const cfg_type_t *type) { + UNUSED(type); + cfg_print_cstr(pctx, "[ ]"); +} + static cfg_type_t cfg_type_optional_facility = { - "optional_facility", parse_optional_facility, NULL, cfg_doc_terminal, - NULL, NULL }; + "optional_facility", parse_optional_facility, NULL, + doc_optional_facility, NULL, NULL }; /*% @@ -2592,8 +2660,13 @@ parse_logversions(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) { return (parse_enum_or_other(pctx, type, &cfg_type_uint32, ret)); } +static void +doc_logversions(cfg_printer_t *pctx, const cfg_type_t *type) { + doc_enum_or_other(pctx, type, &cfg_type_uint32); +} + static cfg_type_t cfg_type_logversions = { - "logversions", parse_logversions, cfg_print_ustring, cfg_doc_terminal, + "logversions", parse_logversions, cfg_print_ustring, doc_logversions, &cfg_rep_string, logversions_enums }; diff --git a/contrib/bind9/lib/isccfg/parser.c b/contrib/bind9/lib/isccfg/parser.c index 7c969961f..c3eb5b105 100644 --- a/contrib/bind9/lib/isccfg/parser.c +++ b/contrib/bind9/lib/isccfg/parser.c @@ -262,10 +262,11 @@ cfg_print_tuple(cfg_printer_t *pctx, const cfg_obj_t *obj) { for (f = fields, i = 0; f->name != NULL; f++, i++) { const cfg_obj_t *fieldobj = obj->value.tuple[i]; - if (need_space) - cfg_print_chars(pctx, " ", 1); + if (need_space && fieldobj->type->rep != &cfg_rep_void) + cfg_print_cstr(pctx, " "); cfg_print_obj(pctx, fieldobj); - need_space = ISC_TF(fieldobj->type->print != cfg_print_void); + need_space = ISC_TF(need_space || + fieldobj->type->print != cfg_print_void); } } @@ -277,7 +278,7 @@ cfg_doc_tuple(cfg_printer_t *pctx, const cfg_type_t *type) { for (f = fields; f->name != NULL; f++) { if (need_space) - cfg_print_chars(pctx, " ", 1); + cfg_print_cstr(pctx, " "); cfg_doc_obj(pctx, f->type); need_space = ISC_TF(f->type->print != cfg_print_void); } diff --git a/contrib/bind9/lib/lwres/Makefile.in b/contrib/bind9/lib/lwres/Makefile.in index dd8eb65ee..e0d1ec6ba 100644 --- a/contrib/bind9/lib/lwres/Makefile.in +++ b/contrib/bind9/lib/lwres/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2005, 2007, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2005, 2007, 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2000, 2001 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @LIBLWRES_API@ diff --git a/contrib/bind9/lib/lwres/man/Makefile.in b/contrib/bind9/lib/lwres/man/Makefile.in index 80db9f2ff..f8446fed6 100644 --- a/contrib/bind9/lib/lwres/man/Makefile.in +++ b/contrib/bind9/lib/lwres/man/Makefile.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004, 2007, 2012 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004, 2007, 2012, 2015 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 2001 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -19,7 +19,7 @@ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ -@BIND9_VERSION@ +VERSION=@BIND9_VERSION@ @BIND9_MAKE_RULES@ diff --git a/contrib/bind9/lib/lwres/man/lwres.3 b/contrib/bind9/lib/lwres/man/lwres.3 index 2c03e3ae9..4d1eec7e6 100644 --- a/contrib/bind9/lib/lwres/man/lwres.3 +++ b/contrib/bind9/lib/lwres/man/lwres.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,36 +13,54 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres \- introduction to the lightweight resolver library .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi +.ft .SH "DESCRIPTION" .PP -The BIND 9 lightweight resolver library is a simple, name service independent stub resolver library. It provides hostname\-to\-address and address\-to\-hostname lookup services to applications by transmitting lookup requests to a resolver daemon +The BIND 9 lightweight resolver library is a simple, name service independent stub resolver library\&. It provides hostname\-to\-address and address\-to\-hostname lookup services to applications by transmitting lookup requests to a resolver daemon \fBlwresd\fR -running on the local host. The resolver daemon performs the lookup using the DNS or possibly other name service protocols, and returns the results to the application through the library. The library and resolver daemon communicate using a simple UDP\-based protocol. +running on the local host\&. The resolver daemon performs the lookup using the DNS or possibly other name service protocols, and returns the results to the application through the library\&. The library and resolver daemon communicate using a simple UDP\-based protocol\&. .SH "OVERVIEW" .PP -The lwresd library implements multiple name service APIs. The standard +The lwresd library implements multiple name service APIs\&. The standard \fBgethostbyname()\fR, \fBgethostbyaddr()\fR, \fBgethostbyname_r()\fR, @@ -50,66 +68,66 @@ The lwresd library implements multiple name service APIs. The standard \fBgetaddrinfo()\fR, \fBgetipnodebyname()\fR, and \fBgetipnodebyaddr()\fR -functions are all supported. To allow the lwres library to coexist with system libraries that define functions of the same name, the library defines these functions with names prefixed by -lwres_. To define the standard names, applications must include the header file -\fI\fR +functions are all supported\&. To allow the lwres library to coexist with system libraries that define functions of the same name, the library defines these functions with names prefixed by +lwres_\&. To define the standard names, applications must include the header file + which contains macro definitions mapping the standard function names into lwres_ -prefixed ones. Operating system vendors who integrate the lwres library into their base distributions should rename the functions in the library proper so that the renaming macros are not needed. +prefixed ones\&. Operating system vendors who integrate the lwres library into their base distributions should rename the functions in the library proper so that the renaming macros are not needed\&. .PP The library also provides a native API consisting of the functions \fBlwres_getaddrsbyname()\fR and -\fBlwres_getnamebyaddr()\fR. These may be called by applications that require more detailed control over the lookup process than the standard functions provide. +\fBlwres_getnamebyaddr()\fR\&. These may be called by applications that require more detailed control over the lookup process than the standard functions provide\&. .PP In addition to these name service independent address lookup functions, the library implements a new, experimental API for looking up arbitrary DNS resource records, using the \fBlwres_getaddrsbyname()\fR -function. +function\&. .PP -Finally, there is a low\-level API for converting lookup requests and responses to and from raw lwres protocol packets. This API can be used by clients requiring nonblocking operation, and is also used when implementing the server side of the lwres protocol, for example in the +Finally, there is a low\-level API for converting lookup requests and responses to and from raw lwres protocol packets\&. This API can be used by clients requiring nonblocking operation, and is also used when implementing the server side of the lwres protocol, for example in the \fBlwresd\fR -resolver daemon. The use of this low\-level API in clients and servers is outlined in the following sections. -.SH "CLIENT\-SIDE LOW\-LEVEL API CALL FLOW" +resolver daemon\&. The use of this low\-level API in clients and servers is outlined in the following sections\&. +.SH "CLIENT-SIDE LOW-LEVEL API CALL FLOW" .PP -When a client program wishes to make an lwres request using the native low\-level API, it typically performs the following sequence of actions. +When a client program wishes to make an lwres request using the native low\-level API, it typically performs the following sequence of actions\&. .PP (1) Allocate or use an existing \fBlwres_packet_t\fR, called \fIpkt\fR -below. +below\&. .PP (2) Set -pkt.recvlength -to the maximum length we will accept. This is done so the receiver of our packets knows how large our receive buffer is. The "default" is a constant in -\fIlwres.h\fR: -\fBLWRES_RECVLENGTH = 4096\fR. +\fIpkt\&.recvlength\fR +to the maximum length we will accept\&. This is done so the receiver of our packets knows how large our receive buffer is\&. The "default" is a constant in +lwres\&.h: +\fBLWRES_RECVLENGTH = 4096\fR\&. .PP (3) Set -pkt.serial -to a unique serial number. This value is echoed back to the application by the remote server. +\fIpkt\&.serial\fR +to a unique serial number\&. This value is echoed back to the application by the remote server\&. .PP (4) Set -pkt.pktflags. Usually this is set to 0. +\fIpkt\&.pktflags\fR\&. Usually this is set to 0\&. .PP (5) Set -pkt.result -to 0. +\fIpkt\&.result\fR +to 0\&. .PP (6) Call \fBlwres_*request_render()\fR, or marshall in the data using the primitives such as \fBlwres_packet_render()\fR -and storing the packet data. +and storing the packet data\&. .PP -(7) Transmit the resulting buffer. +(7) Transmit the resulting buffer\&. .PP (8) Call \fBlwres_*response_parse()\fR -to parse any packets received. +to parse any packets received\&. .PP -(9) Verify that the opcode and serial match a request, and process the packet specific information contained in the body. -.SH "SERVER\-SIDE LOW\-LEVEL API CALL FLOW" +(9) Verify that the opcode and serial match a request, and process the packet specific information contained in the body\&. +.SH "SERVER-SIDE LOW-LEVEL API CALL FLOW" .PP -When implementing the server side of the lightweight resolver protocol using the lwres library, a sequence of actions like the following is typically involved in processing each request packet. +When implementing the server side of the lightweight resolver protocol using the lwres library, a sequence of actions like the following is typically involved in processing each request packet\&. .PP Note that the same \fBlwres_packet_t\fR @@ -117,34 +135,34 @@ is used in both the \fB_parse()\fR and \fB_render()\fR -calls, with only a few modifications made to the packet header's contents between uses. This method is recommended as it keeps the serial, opcode, and other fields correct. +calls, with only a few modifications made to the packet header\*(Aqs contents between uses\&. This method is recommended as it keeps the serial, opcode, and other fields correct\&. .PP (1) When a packet is received, call \fBlwres_*request_parse()\fR -to unmarshall it. This returns a +to unmarshall it\&. This returns a \fBlwres_packet_t\fR (also called \fIpkt\fR, below) as well as a data specific type, such as -\fBlwres_gabnrequest_t\fR. +\fBlwres_gabnrequest_t\fR\&. .PP -(2) Process the request in the data specific type. +(2) Process the request in the data specific type\&. .PP (3) Set the -pkt.result, -pkt.recvlength -as above. All other fields can be left untouched since they were filled in by the +\fIpkt\&.result\fR, +\fIpkt\&.recvlength\fR +as above\&. All other fields can be left untouched since they were filled in by the \fB*_parse()\fR -call above. If using +call above\&. If using \fBlwres_*response_render()\fR, -pkt.pktflags -will be set up properly. Otherwise, the +\fIpkt\&.pktflags\fR +will be set up properly\&. Otherwise, the \fBLWRES_LWPACKETFLAG_RESPONSE\fR -bit should be set. +bit should be set\&. .PP (4) Call the data specific rendering function, such as -\fBlwres_gabnresponse_render()\fR. +\fBlwres_gabnresponse_render()\fR\&. .PP -(5) Send the resulting packet to the client. +(5) Send the resulting packet to the client\&. .PP .SH "SEE ALSO" .PP @@ -157,9 +175,13 @@ bit should be set. \fBlwres_context\fR(3), \fBlwres_config\fR(3), \fBresolver\fR(5), -\fBlwresd\fR(8). +\fBlwresd\fR(8)\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres.docbook b/contrib/bind9/lib/lwres/man/lwres.docbook index 26723e5f0..5e84ee970 100644 --- a/contrib/bind9/lib/lwres/man/lwres.docbook +++ b/contrib/bind9/lib/lwres/man/lwres.docbook @@ -1,8 +1,5 @@ -]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -40,6 +41,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -55,8 +57,8 @@ - - DESCRIPTION + DESCRIPTION + The BIND 9 lightweight resolver library is a simple, name service independent stub resolver library. It provides hostname-to-address @@ -69,10 +71,10 @@ The library and resolver daemon communicate using a simple UDP-based protocol. - + + + OVERVIEW - - OVERVIEW The lwresd library implements multiple name service APIs. The standard @@ -124,9 +126,9 @@ resolver daemon. The use of this low-level API in clients and servers is outlined in the following sections. - - - CLIENT-SIDE LOW-LEVEL API CALL FLOW + + CLIENT-SIDE LOW-LEVEL API CALL FLOW + When a client program wishes to make an lwres request using the native low-level API, it typically performs the following @@ -137,23 +139,23 @@ called pkt below. - (2) Set pkt.recvlength to the maximum length + (2) Set pkt.recvlength to the maximum length we will accept. This is done so the receiver of our packets knows how large our receive buffer is. The "default" is a constant in lwres.h: LWRES_RECVLENGTH = 4096. - (3) Set pkt.serial + (3) Set pkt.serial to a unique serial number. This value is echoed back to the application by the remote server. - (4) Set pkt.pktflags. Usually this is set to + (4) Set pkt.pktflags. Usually this is set to 0. - (5) Set pkt.result to 0. + (5) Set pkt.result to 0. (6) Call lwres_*request_render(), @@ -172,9 +174,9 @@ (9) Verify that the opcode and serial match a request, and process the packet specific information contained in the body. - - - SERVER-SIDE LOW-LEVEL API CALL FLOW + + SERVER-SIDE LOW-LEVEL API CALL FLOW + When implementing the server side of the lightweight resolver protocol using the lwres library, a sequence of actions like the @@ -197,12 +199,12 @@ (2) Process the request in the data specific type. - (3) Set the pkt.result, - pkt.recvlength as above. All other fields + (3) Set the pkt.result, + pkt.recvlength as above. All other fields can be left untouched since they were filled in by the *_parse() call above. If using lwres_*response_render(), - pkt.pktflags will be set up + pkt.pktflags will be set up properly. Otherwise, the LWRES_LWPACKETFLAG_RESPONSE bit should be set. @@ -213,10 +215,10 @@ (5) Send the resulting packet to the client. - - - - SEE ALSO + + + SEE ALSO + lwres_gethostent3 , @@ -258,9 +260,5 @@ . - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres.html b/contrib/bind9/lib/lwres/man/lwres.html index cb8a0776a..aa405a4f5 100644 --- a/contrib/bind9/lib/lwres/man/lwres.html +++ b/contrib/bind9/lib/lwres/man/lwres.html @@ -1,5 +1,5 @@ - lwres - + -
-
+
+

Name

lwres — introduction to the lightweight resolver library

@@ -31,14 +30,14 @@

Synopsis

#include <lwres/lwres.h>
-
-

DESCRIPTION

+
+

DESCRIPTION

The BIND 9 lightweight resolver library is a simple, name service independent stub resolver library. It provides hostname-to-address and address-to-hostname lookup services to applications by transmitting lookup requests to a resolver daemon - lwresd + lwresd running on the local host. The resolver daemon performs the lookup using the DNS or possibly other name service protocols, and returns the results to the application through the library. @@ -46,8 +45,8 @@ UDP-based protocol.

-
-

OVERVIEW

+
+

OVERVIEW

The lwresd library implements multiple name service APIs. The standard @@ -95,13 +94,13 @@ This API can be used by clients requiring nonblocking operation, and is also used when implementing the server side of the lwres protocol, for example in the - lwresd + lwresd resolver daemon. The use of this low-level API in clients and servers is outlined in the following sections.

-
-

CLIENT-SIDE LOW-LEVEL API CALL FLOW

+
+

CLIENT-SIDE LOW-LEVEL API CALL FLOW

When a client program wishes to make an lwres request using the native low-level API, it typically performs the following @@ -112,23 +111,23 @@ called pkt below.

- (2) Set pkt.recvlength to the maximum length + (2) Set pkt.recvlength to the maximum length we will accept. This is done so the receiver of our packets knows how large our receive buffer is. The "default" is a constant in lwres.h: LWRES_RECVLENGTH = 4096.

- (3) Set pkt.serial + (3) Set pkt.serial to a unique serial number. This value is echoed back to the application by the remote server.

- (4) Set pkt.pktflags. Usually this is set to + (4) Set pkt.pktflags. Usually this is set to 0.

- (5) Set pkt.result to 0. + (5) Set pkt.result to 0.

(6) Call lwres_*request_render(), @@ -148,8 +147,8 @@ packet specific information contained in the body.

-
-

SERVER-SIDE LOW-LEVEL API CALL FLOW

+
+

SERVER-SIDE LOW-LEVEL API CALL FLOW

When implementing the server side of the lightweight resolver protocol using the lwres library, a sequence of actions like the @@ -172,12 +171,12 @@ (2) Process the request in the data specific type.

- (3) Set the pkt.result, - pkt.recvlength as above. All other fields + (3) Set the pkt.result, + pkt.recvlength as above. All other fields can be left untouched since they were filled in by the *_parse() call above. If using lwres_*response_render(), - pkt.pktflags will be set up + pkt.pktflags will be set up properly. Otherwise, the LWRES_LWPACKETFLAG_RESPONSE bit should be set.

@@ -190,8 +189,8 @@

-
-

SEE ALSO

+
+

SEE ALSO

lwres_gethostent(3), lwres_getipnode(3), diff --git a/contrib/bind9/lib/lwres/man/lwres_buffer.3 b/contrib/bind9/lib/lwres/man/lwres_buffer.3 index 22b14ab2e..363c0da6d 100644 --- a/contrib/bind9/lib/lwres/man/lwres_buffer.3 +++ b/contrib/bind9/lib/lwres/man/lwres_buffer.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,132 +13,158 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_buffer .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_BUFFER" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_BUFFER" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_buffer_init, lwres_buffer_invalidate, lwres_buffer_add, lwres_buffer_subtract, lwres_buffer_clear, lwres_buffer_first, lwres_buffer_forward, lwres_buffer_back, lwres_buffer_getuint8, lwres_buffer_putuint8, lwres_buffer_getuint16, lwres_buffer_putuint16, lwres_buffer_getuint32, lwres_buffer_putuint32, lwres_buffer_putmem, lwres_buffer_getmem \- lightweight resolver buffer management .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 23 +.ft +.HP \w'void\ lwres_buffer_init('u .BI "void lwres_buffer_init(lwres_buffer_t\ *" "b" ", void\ *" "base" ", unsigned\ int\ " "length" ");" -.HP 29 +.HP \w'void\ lwres_buffer_invalidate('u .BI "void lwres_buffer_invalidate(lwres_buffer_t\ *" "b" ");" -.HP 22 +.HP \w'void\ lwres_buffer_add('u .BI "void lwres_buffer_add(lwres_buffer_t\ *" "b" ", unsigned\ int\ " "n" ");" -.HP 27 +.HP \w'void\ lwres_buffer_subtract('u .BI "void lwres_buffer_subtract(lwres_buffer_t\ *" "b" ", unsigned\ int\ " "n" ");" -.HP 24 +.HP \w'void\ lwres_buffer_clear('u .BI "void lwres_buffer_clear(lwres_buffer_t\ *" "b" ");" -.HP 24 +.HP \w'void\ lwres_buffer_first('u .BI "void lwres_buffer_first(lwres_buffer_t\ *" "b" ");" -.HP 26 +.HP \w'void\ lwres_buffer_forward('u .BI "void lwres_buffer_forward(lwres_buffer_t\ *" "b" ", unsigned\ int\ " "n" ");" -.HP 23 +.HP \w'void\ lwres_buffer_back('u .BI "void lwres_buffer_back(lwres_buffer_t\ *" "b" ", unsigned\ int\ " "n" ");" -.HP 36 +.HP \w'lwres_uint8_t\ lwres_buffer_getuint8('u .BI "lwres_uint8_t lwres_buffer_getuint8(lwres_buffer_t\ *" "b" ");" -.HP 27 +.HP \w'void\ lwres_buffer_putuint8('u .BI "void lwres_buffer_putuint8(lwres_buffer_t\ *" "b" ", lwres_uint8_t\ " "val" ");" -.HP 38 +.HP \w'lwres_uint16_t\ lwres_buffer_getuint16('u .BI "lwres_uint16_t lwres_buffer_getuint16(lwres_buffer_t\ *" "b" ");" -.HP 28 +.HP \w'void\ lwres_buffer_putuint16('u .BI "void lwres_buffer_putuint16(lwres_buffer_t\ *" "b" ", lwres_uint16_t\ " "val" ");" -.HP 38 +.HP \w'lwres_uint32_t\ lwres_buffer_getuint32('u .BI "lwres_uint32_t lwres_buffer_getuint32(lwres_buffer_t\ *" "b" ");" -.HP 28 +.HP \w'void\ lwres_buffer_putuint32('u .BI "void lwres_buffer_putuint32(lwres_buffer_t\ *" "b" ", lwres_uint32_t\ " "val" ");" -.HP 25 +.HP \w'void\ lwres_buffer_putmem('u .BI "void lwres_buffer_putmem(lwres_buffer_t\ *" "b" ", const\ unsigned\ char\ *" "base" ", unsigned\ int\ " "length" ");" -.HP 25 +.HP \w'void\ lwres_buffer_getmem('u .BI "void lwres_buffer_getmem(lwres_buffer_t\ *" "b" ", unsigned\ char\ *" "base" ", unsigned\ int\ " "length" ");" .SH "DESCRIPTION" .PP -These functions provide bounds checked access to a region of memory where data is being read or written. They are based on, and similar to, the +These functions provide bounds checked access to a region of memory where data is being read or written\&. They are based on, and similar to, the isc_buffer_ -functions in the ISC library. +functions in the ISC library\&. .PP -A buffer is a region of memory, together with a set of related subregions. The +A buffer is a region of memory, together with a set of related subregions\&. The \fIused region\fR and the \fIavailable\fR -region are disjoint, and their union is the buffer's region. The used region extends from the beginning of the buffer region to the last used byte. The available region extends from one byte greater than the last used byte to the end of the buffer's region. The size of the used region can be changed using various buffer commands. Initially, the used region is empty. +region are disjoint, and their union is the buffer\*(Aqs region\&. The used region extends from the beginning of the buffer region to the last used byte\&. The available region extends from one byte greater than the last used byte to the end of the buffer\*(Aqs region\&. The size of the used region can be changed using various buffer commands\&. Initially, the used region is empty\&. .PP The used region is further subdivided into two disjoint regions: the \fIconsumed region\fR and the -\fIremaining region\fR. The union of these two regions is the used region. The consumed region extends from the beginning of the used region to the byte before the +\fIremaining region\fR\&. The union of these two regions is the used region\&. The consumed region extends from the beginning of the used region to the byte before the \fIcurrent\fR -offset (if any). The +offset (if any)\&. The \fIremaining\fR -region the current pointer to the end of the used region. The size of the consumed region can be changed using various buffer commands. Initially, the consumed region is empty. +region the current pointer to the end of the used region\&. The size of the consumed region can be changed using various buffer commands\&. Initially, the consumed region is empty\&. .PP The \fIactive region\fR -is an (optional) subregion of the remaining region. It extends from the current offset to an offset in the remaining region. Initially, the active region is empty. If the current offset advances beyond the chosen offset, the active region will also be empty. +is an (optional) subregion of the remaining region\&. It extends from the current offset to an offset in the remaining region\&. Initially, the active region is empty\&. If the current offset advances beyond the chosen offset, the active region will also be empty\&. .PP +.if n \{\ .RS 4 +.\} .nf - /\-\-\-\-\-\-\-\-\-\-\-\-entire length\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\\\\ - /\-\-\-\-\- used region \-\-\-\-\-\\\\/\-\- available \-\-\\\\ + /\-\-\-\-\-\-\-\-\-\-\-\-entire length\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\e\e + /\-\-\-\-\- used region \-\-\-\-\-\e\e/\-\- available \-\-\e\e +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ | consumed | remaining | | +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ a b c d e .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf - a == base of buffer. - b == current pointer. Can be anywhere between a and d. - c == active pointer. Meaningful between b and d. - d == used pointer. - e == length of buffer. + a == base of buffer\&. + b == current pointer\&. Can be anywhere between a and d\&. + c == active pointer\&. Meaningful between b and d\&. + d == used pointer\&. + e == length of buffer\&. .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf - a\-e == entire length of buffer. - a\-d == used region. - a\-b == consumed region. - b\-d == remaining region. - b\-c == optional active region. + a\-e == entire length of buffer\&. + a\-d == used region\&. + a\-b == consumed region\&. + b\-d == remaining region\&. + b\-c == optional active region\&. .fi +.if n \{\ .RE -.sp +.\} .PP \fBlwres_buffer_init()\fR initializes the -\fBlwres_buffer_t\fR -\fI*b\fR +\fBlwres_buffer_t\fR\fI*b\fR and assocates it with the memory region of size \fIlength\fR bytes starting at location -\fIbase.\fR +\fIbase\&.\fR .PP \fBlwres_buffer_invalidate()\fR marks the buffer \fI*b\fR -as invalid. Invalidating a buffer after use is not required, but makes it possible to catch its possible accidental use. +as invalid\&. Invalidating a buffer after use is not required, but makes it possible to catch its possible accidental use\&. .PP The functions \fBlwres_buffer_add()\fR @@ -148,49 +174,49 @@ respectively increase and decrease the used space in buffer \fI*b\fR by \fIn\fR -bytes. +bytes\&. \fBlwres_buffer_add()\fR checks for buffer overflow and \fBlwres_buffer_subtract()\fR -checks for underflow. These functions do not allocate or deallocate memory. They just change the value of -used. +checks for underflow\&. These functions do not allocate or deallocate memory\&. They just change the value of +\fIused\fR\&. .PP A buffer is re\-initialised by -\fBlwres_buffer_clear()\fR. The function sets -used, -current +\fBlwres_buffer_clear()\fR\&. The function sets +\fIused\fR, +\fIcurrent\fR and -active -to zero. +\fIactive\fR +to zero\&. .PP \fBlwres_buffer_first\fR makes the consumed region of buffer \fI*p\fR empty by setting -current -to zero (the start of the buffer). +\fIcurrent\fR +to zero (the start of the buffer)\&. .PP \fBlwres_buffer_forward()\fR increases the consumed region of buffer \fI*b\fR by \fIn\fR -bytes, checking for overflow. Similarly, +bytes, checking for overflow\&. Similarly, \fBlwres_buffer_back()\fR decreases buffer -\fIb\fR's consumed region by +\fIb\fR\*(Aqs consumed region by \fIn\fR -bytes and checks for underflow. +bytes and checks for underflow\&. .PP \fBlwres_buffer_getuint8()\fR reads an unsigned 8\-bit integer from \fI*b\fR -and returns it. +and returns it\&. \fBlwres_buffer_putuint8()\fR writes the unsigned 8\-bit integer \fIval\fR to buffer -\fI*b\fR. +\fI*b\fR\&. .PP \fBlwres_buffer_getuint16()\fR and @@ -198,36 +224,40 @@ and are identical to \fBlwres_buffer_putuint8()\fR except that they respectively read an unsigned 16\-bit or 32\-bit integer in network byte order from -\fIb\fR. Similarly, +\fIb\fR\&. Similarly, \fBlwres_buffer_putuint16()\fR and \fBlwres_buffer_putuint32()\fR writes the unsigned 16\-bit or 32\-bit integer \fIval\fR to buffer -\fIb\fR, in network byte order. +\fIb\fR, in network byte order\&. .PP Arbitrary amounts of data are read or written from a lightweight resolver buffer with \fBlwres_buffer_getmem()\fR and \fBlwres_buffer_putmem()\fR -respectively. +respectively\&. \fBlwres_buffer_putmem()\fR copies \fIlength\fR bytes of memory at \fIbase\fR to -\fIb\fR. Conversely, +\fIb\fR\&. Conversely, \fBlwres_buffer_getmem()\fR copies \fIlength\fR bytes of memory from \fIb\fR to -\fIbase\fR. +\fIbase\fR\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_buffer.docbook b/contrib/bind9/lib/lwres/man/lwres_buffer.docbook index 17ccbf549..532a09c23 100644 --- a/contrib/bind9/lib/lwres/man/lwres_buffer.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_buffer.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -35,6 +37,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -199,9 +202,9 @@ void - + DESCRIPTION + - DESCRIPTION These functions provide bounds checked access to a region of memory where data is being read or written. @@ -302,23 +305,23 @@ void checks for underflow. These functions do not allocate or deallocate memory. They just change the value of - used. + used. A buffer is re-initialised by lwres_buffer_clear(). The function sets - used, - current + used, + current and - active + active to zero. lwres_buffer_first makes the consumed region of buffer *p empty by setting - current + current to zero (the start of the buffer). lwres_buffer_forward() @@ -386,9 +389,5 @@ void to base. - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_buffer.html b/contrib/bind9/lib/lwres/man/lwres_buffer.html index 4e7735ef8..05c3eead7 100644 --- a/contrib/bind9/lib/lwres/man/lwres_buffer.html +++ b/contrib/bind9/lib/lwres/man/lwres_buffer.html @@ -1,5 +1,5 @@ - lwres_buffer - + -

-
+
+

Name

lwres_buffer_init, lwres_buffer_invalidate, lwres_buffer_add, lwres_buffer_subtract, lwres_buffer_clear, lwres_buffer_first, lwres_buffer_forward, lwres_buffer_back, lwres_buffer_getuint8, lwres_buffer_putuint8, lwres_buffer_getuint16, lwres_buffer_putuint16, lwres_buffer_getuint32, lwres_buffer_putuint32, lwres_buffer_putmem, lwres_buffer_getmem — lightweight resolver buffer management

@@ -33,236 +32,194 @@ 
 #include <lwres/lwbuffer.h>
- +
- - + - - + - - +
void lwres_buffer_init(lwres_buffer_t *  -b, lwres_buffer_t *b,
 void *  -base, void *base,
 unsigned int   -length);unsigned int length);
- +
 
+
- - +
void lwres_buffer_invalidate(lwres_buffer_t *  -b);lwres_buffer_t *b);
- +
 
+
- - + - - +
void lwres_buffer_add(lwres_buffer_t *  -b, lwres_buffer_t *b,
 unsigned int   -n);unsigned int n);
- +
 
+
- - + - - +
void lwres_buffer_subtract(lwres_buffer_t *  -b, lwres_buffer_t *b,
 unsigned int   -n);unsigned int n);
- +
 
+
- - +
void lwres_buffer_clear(lwres_buffer_t *  -b);lwres_buffer_t *b);
- +
 
+
- - +
void lwres_buffer_first(lwres_buffer_t *  -b);lwres_buffer_t *b);
- +
 
+
- - + - - +
void lwres_buffer_forward(lwres_buffer_t *  -b, lwres_buffer_t *b,
 unsigned int   -n);unsigned int n);
- +
 
+
- - + - - +
void lwres_buffer_back(lwres_buffer_t *  -b, lwres_buffer_t *b,
 unsigned int   -n);unsigned int n);
- +
 
+
- - +
lwres_uint8_t lwres_buffer_getuint8(lwres_buffer_t *  -b);lwres_buffer_t *b);
- +
 
+
- - + - - +
void lwres_buffer_putuint8(lwres_buffer_t *  -b, lwres_buffer_t *b,
 lwres_uint8_t   -val);lwres_uint8_t val);
- +
 
+
- - +
lwres_uint16_t lwres_buffer_getuint16(lwres_buffer_t *  -b);lwres_buffer_t *b);
- +
 
+
- - + - - +
void lwres_buffer_putuint16(lwres_buffer_t *  -b, lwres_buffer_t *b,
 lwres_uint16_t   -val);lwres_uint16_t val);
- +
 
+
- - +
lwres_uint32_t lwres_buffer_getuint32(lwres_buffer_t *  -b);lwres_buffer_t *b);
- +
 
+
- - + - - +
void lwres_buffer_putuint32(lwres_buffer_t *  -b, lwres_buffer_t *b,
 lwres_uint32_t   -val);lwres_uint32_t val);
- +
 
+
- - + - - + - - +
void lwres_buffer_putmem(lwres_buffer_t *  -b, lwres_buffer_t *b,
 const unsigned char *  -base, const unsigned char *base,
 unsigned int   -length);unsigned int length);
- +
 
+
- - + - - + - - +
void lwres_buffer_getmem(lwres_buffer_t *  -b, lwres_buffer_t *b,
 unsigned char *  -base, unsigned char *base,
 unsigned int   -length);unsigned int length);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

These functions provide bounds checked access to a region of memory where data is being read or written. @@ -366,23 +323,23 @@ void checks for underflow. These functions do not allocate or deallocate memory. They just change the value of - used. + used.

A buffer is re-initialised by lwres_buffer_clear(). The function sets - used, - current + used, + current and - active + active to zero.

lwres_buffer_first makes the consumed region of buffer *p empty by setting - current + current to zero (the start of the buffer).

lwres_buffer_forward() diff --git a/contrib/bind9/lib/lwres/man/lwres_config.3 b/contrib/bind9/lib/lwres/man/lwres_config.3 index 25b118100..aff3233b8 100644 --- a/contrib/bind9/lib/lwres/man/lwres_config.3 +++ b/contrib/bind9/lib/lwres/man/lwres_config.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,37 +13,55 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_config .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_CONFIG" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_CONFIG" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_conf_init, lwres_conf_clear, lwres_conf_parse, lwres_conf_print, lwres_conf_get \- lightweight resolver configuration .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 21 +.ft +.HP \w'void\ lwres_conf_init('u .BI "void lwres_conf_init(lwres_context_t\ *" "ctx" ");" -.HP 22 +.HP \w'void\ lwres_conf_clear('u .BI "void lwres_conf_clear(lwres_context_t\ *" "ctx" ");" -.HP 32 +.HP \w'lwres_result_t\ lwres_conf_parse('u .BI "lwres_result_t lwres_conf_parse(lwres_context_t\ *" "ctx" ", const\ char\ *" "filename" ");" -.HP 32 +.HP \w'lwres_result_t\ lwres_conf_print('u .BI "lwres_result_t lwres_conf_print(lwres_context_t\ *" "ctx" ", FILE\ *" "fp" ");" -.HP 30 +.HP \w'lwres_conf_t\ *\ lwres_conf_get('u .BI "lwres_conf_t * lwres_conf_get(lwres_context_t\ *" "ctx" ");" .SH "DESCRIPTION" .PP @@ -51,21 +69,21 @@ lwres_conf_init, lwres_conf_clear, lwres_conf_parse, lwres_conf_print, lwres_con creates an empty \fBlwres_conf_t\fR structure for lightweight resolver context -\fIctx\fR. +\fIctx\fR\&. .PP \fBlwres_conf_clear()\fR frees up all the internal memory used by that \fBlwres_conf_t\fR structure in resolver context -\fIctx\fR. +\fIctx\fR\&. .PP \fBlwres_conf_parse()\fR opens the file \fIfilename\fR and parses it to initialise the resolver context -\fIctx\fR's +\fIctx\fR\*(Aqs \fBlwres_conf_t\fR -structure. +structure\&. .PP \fBlwres_conf_print()\fR prints the @@ -73,34 +91,37 @@ prints the structure for resolver context \fIctx\fR to the -\fBFILE\fR -\fIfp\fR. +\fBFILE\fR\fIfp\fR\&. .SH "RETURN VALUES" .PP \fBlwres_conf_parse()\fR returns \fBLWRES_R_SUCCESS\fR if it successfully read and parsed -\fIfilename\fR. It returns +\fIfilename\fR\&. It returns \fBLWRES_R_FAILURE\fR if \fIfilename\fR -could not be opened or contained incorrect resolver statements. +could not be opened or contained incorrect resolver statements\&. .PP \fBlwres_conf_print()\fR returns \fBLWRES_R_SUCCESS\fR -unless an error occurred when converting the network addresses to a numeric host address string. If this happens, the function returns -\fBLWRES_R_FAILURE\fR. +unless an error occurred when converting the network addresses to a numeric host address string\&. If this happens, the function returns +\fBLWRES_R_FAILURE\fR\&. .SH "SEE ALSO" .PP \fBstdio\fR(3), -\fBresolver\fR(5). +\fBresolver\fR(5)\&. .SH "FILES" .PP -\fI/etc/resolv.conf\fR +/etc/resolv\&.conf +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_config.docbook b/contrib/bind9/lib/lwres/man/lwres_config.docbook index 5af37eaf7..0a40ee5f4 100644 --- a/contrib/bind9/lib/lwres/man/lwres_config.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_config.docbook @@ -1,8 +1,5 @@ -]> - + + + + 2007-06-18 + - - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +37,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -92,8 +94,8 @@ lwres_conf_t * - - DESCRIPTION + DESCRIPTION + lwres_conf_init() creates an empty @@ -128,10 +130,10 @@ lwres_conf_t * FILE fp. - - + + RETURN VALUES + - RETURN VALUES lwres_conf_parse() returns LWRES_R_SUCCESS @@ -150,9 +152,9 @@ lwres_conf_t * If this happens, the function returns LWRES_R_FAILURE. - - - SEE ALSO + + SEE ALSO + stdio3 , @@ -160,14 +162,10 @@ lwres_conf_t * resolver5 . - - - FILES + + FILES + /etc/resolv.conf - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_config.html b/contrib/bind9/lib/lwres/man/lwres_config.html index b3b81f7a8..f6337bb9e 100644 --- a/contrib/bind9/lib/lwres/man/lwres_config.html +++ b/contrib/bind9/lib/lwres/man/lwres_config.html @@ -1,5 +1,5 @@ - lwres_config - + -

-
+
+

Name

lwres_conf_init, lwres_conf_clear, lwres_conf_parse, lwres_conf_print, lwres_conf_get — lightweight resolver configuration

@@ -31,66 +30,57 @@

Synopsis

#include <lwres/lwres.h>
- +
- - +
void lwres_conf_init(lwres_context_t *  -ctx);lwres_context_t *ctx);
- +
 
+
- - +
void lwres_conf_clear(lwres_context_t *  -ctx);lwres_context_t *ctx);
- +
 
+
- - + - - +
lwres_result_t lwres_conf_parse(lwres_context_t *  -ctx, lwres_context_t *ctx,
 const char *  -filename);const char *filename);
- +
 
+
- - + - - +
lwres_result_t lwres_conf_print(lwres_context_t *  -ctx, lwres_context_t *ctx,
 FILE *  -fp);FILE *fp);
- +
 
+
- - +
lwres_conf_t * lwres_conf_get(lwres_context_t *  -ctx);lwres_context_t *ctx);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

lwres_conf_init() creates an empty lwres_conf_t @@ -122,8 +112,8 @@ lwres_conf_t * fp.

-
-

RETURN VALUES

+
+

RETURN VALUES

lwres_conf_parse() returns LWRES_R_SUCCESS if it successfully read and parsed @@ -141,14 +131,14 @@ lwres_conf_t * LWRES_R_FAILURE.

-
-

SEE ALSO

+
+

SEE ALSO

stdio(3), resolver(5).

-
-

FILES

+
+

FILES

/etc/resolv.conf

diff --git a/contrib/bind9/lib/lwres/man/lwres_context.3 b/contrib/bind9/lib/lwres/man/lwres_context.3 index d544a3c39..77c1342b8 100644 --- a/contrib/bind9/lib/lwres/man/lwres_context.3 +++ b/contrib/bind9/lib/lwres/man/lwres_context.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,126 +13,144 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_context .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_CONTEXT" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_CONTEXT" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_context_create, lwres_context_destroy, lwres_context_nextserial, lwres_context_initserial, lwres_context_freemem, lwres_context_allocmem, lwres_context_sendrecv \- lightweight resolver context management .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 36 +.ft +.HP \w'lwres_result_t\ lwres_context_create('u .BI "lwres_result_t lwres_context_create(lwres_context_t\ **" "contextp" ", void\ *" "arg" ", lwres_malloc_t\ " "malloc_function" ", lwres_free_t\ " "free_function" ");" -.HP 37 +.HP \w'lwres_result_t\ lwres_context_destroy('u .BI "lwres_result_t lwres_context_destroy(lwres_context_t\ **" "contextp" ");" -.HP 30 +.HP \w'void\ lwres_context_initserial('u .BI "void lwres_context_initserial(lwres_context_t\ *" "ctx" ", lwres_uint32_t\ " "serial" ");" -.HP 40 +.HP \w'lwres_uint32_t\ lwres_context_nextserial('u .BI "lwres_uint32_t lwres_context_nextserial(lwres_context_t\ *" "ctx" ");" -.HP 27 +.HP \w'void\ lwres_context_freemem('u .BI "void lwres_context_freemem(lwres_context_t\ *" "ctx" ", void\ *" "mem" ", size_t\ " "len" ");" -.HP 28 +.HP \w'void\ lwres_context_allocmem('u .BI "void lwres_context_allocmem(lwres_context_t\ *" "ctx" ", size_t\ " "len" ");" -.HP 30 +.HP \w'void\ *\ lwres_context_sendrecv('u .BI "void * lwres_context_sendrecv(lwres_context_t\ *" "ctx" ", void\ *" "sendbase" ", int\ " "sendlen" ", void\ *" "recvbase" ", int\ " "recvlen" ", int\ *" "recvd_len" ");" .SH "DESCRIPTION" .PP \fBlwres_context_create()\fR creates a \fBlwres_context_t\fR -structure for use in lightweight resolver operations. It holds a socket and other data needed for communicating with a resolver daemon. The new +structure for use in lightweight resolver operations\&. It holds a socket and other data needed for communicating with a resolver daemon\&. The new \fBlwres_context_t\fR is returned through \fIcontextp\fR, a pointer to a \fBlwres_context_t\fR -pointer. This +pointer\&. This \fBlwres_context_t\fR pointer must initially be NULL, and is modified to point to the newly created -\fBlwres_context_t\fR. +\fBlwres_context_t\fR\&. .PP When the lightweight resolver needs to perform dynamic memory allocation, it will call \fImalloc_function\fR to allocate memory and \fIfree_function\fR -to free it. If +to free it\&. If \fImalloc_function\fR and \fIfree_function\fR are NULL, memory is allocated using -\fBmalloc\fR(3). and -\fBfree\fR(3). It is not permitted to have a NULL +\fBmalloc\fR(3)\&. and +\fBfree\fR(3)\&. It is not permitted to have a NULL \fImalloc_function\fR and a non\-NULL \fIfree_function\fR -or vice versa. +or vice versa\&. \fIarg\fR -is passed as the first parameter to the memory allocation functions. If +is passed as the first parameter to the memory allocation functions\&. If \fImalloc_function\fR and \fIfree_function\fR are NULL, \fIarg\fR -is unused and should be passed as NULL. +is unused and should be passed as NULL\&. .PP Once memory for the structure has been allocated, it is initialized using \fBlwres_conf_init\fR(3) and returned via -\fI*contextp\fR. +\fI*contextp\fR\&. .PP \fBlwres_context_destroy()\fR destroys a -\fBlwres_context_t\fR, closing its socket. +\fBlwres_context_t\fR, closing its socket\&. \fIcontextp\fR -is a pointer to a pointer to the context that is to be destroyed. The pointer will be set to NULL when the context has been destroyed. +is a pointer to a pointer to the context that is to be destroyed\&. The pointer will be set to NULL when the context has been destroyed\&. .PP -The context holds a serial number that is used to identify resolver request packets and associate responses with the corresponding requests. This serial number is controlled using +The context holds a serial number that is used to identify resolver request packets and associate responses with the corresponding requests\&. This serial number is controlled using \fBlwres_context_initserial()\fR and -\fBlwres_context_nextserial()\fR. +\fBlwres_context_nextserial()\fR\&. \fBlwres_context_initserial()\fR sets the serial number for context \fI*ctx\fR to -\fIserial\fR. +\fIserial\fR\&. \fBlwres_context_nextserial()\fR -increments the serial number and returns the previous value. +increments the serial number and returns the previous value\&. .PP Memory for a lightweight resolver context is allocated and freed using \fBlwres_context_allocmem()\fR and -\fBlwres_context_freemem()\fR. These use whatever allocations were defined when the context was created with -\fBlwres_context_create()\fR. +\fBlwres_context_freemem()\fR\&. These use whatever allocations were defined when the context was created with +\fBlwres_context_create()\fR\&. \fBlwres_context_allocmem()\fR allocates \fIlen\fR -bytes of memory and if successful returns a pointer to the allocated storage. +bytes of memory and if successful returns a pointer to the allocated storage\&. \fBlwres_context_freemem()\fR frees \fIlen\fR bytes of space starting at location -\fImem\fR. +\fImem\fR\&. .PP \fBlwres_context_sendrecv()\fR performs I/O for the context -\fIctx\fR. Data are read and written from the context's socket. It writes data from +\fIctx\fR\&. Data are read and written from the context\*(Aqs socket\&. It writes data from \fIsendbase\fR \(em typically a lightweight resolver query packet \(em and waits for a reply which is copied to the receive buffer at -\fIrecvbase\fR. The number of bytes that were written to this receive buffer is returned in -\fI*recvd_len\fR. +\fIrecvbase\fR\&. The number of bytes that were written to this receive buffer is returned in +\fI*recvd_len\fR\&. .SH "RETURN VALUES" .PP \fBlwres_context_create()\fR @@ -142,29 +160,33 @@ if memory for the \fBstruct lwres_context\fR could not be allocated, \fBLWRES_R_SUCCESS\fR -otherwise. +otherwise\&. .PP Successful calls to the memory allocator \fBlwres_context_allocmem()\fR -return a pointer to the start of the allocated space. It returns NULL if memory could not be allocated. +return a pointer to the start of the allocated space\&. It returns NULL if memory could not be allocated\&. .PP \fBLWRES_R_SUCCESS\fR is returned when \fBlwres_context_sendrecv()\fR -completes successfully. +completes successfully\&. \fBLWRES_R_IOERROR\fR is returned if an I/O error occurs and \fBLWRES_R_TIMEOUT\fR is returned if \fBlwres_context_sendrecv()\fR -times out waiting for a response. +times out waiting for a response\&. .SH "SEE ALSO" .PP \fBlwres_conf_init\fR(3), \fBmalloc\fR(3), -\fBfree\fR(3). +\fBfree\fR(3)\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001, 2003 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_context.docbook b/contrib/bind9/lib/lwres/man/lwres_context.docbook index e0a45eecf..edfdde68e 100644 --- a/contrib/bind9/lib/lwres/man/lwres_context.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_context.docbook @@ -1,8 +1,7 @@ -]> +]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +39,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -115,8 +119,8 @@ void * - - DESCRIPTION + DESCRIPTION + lwres_context_create() creates a lwres_context_t structure for use in @@ -212,10 +216,10 @@ void * written to this receive buffer is returned in *recvd_len. - + + + RETURN VALUES - - RETURN VALUES lwres_context_create() returns LWRES_R_NOMEMORY if memory for @@ -239,9 +243,9 @@ void * lwres_context_sendrecv() times out waiting for a response. - - - SEE ALSO + + SEE ALSO + lwres_conf_init3 , @@ -254,9 +258,5 @@ void * free3 . - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_context.html b/contrib/bind9/lib/lwres/man/lwres_context.html index ba6b858a4..919dff77f 100644 --- a/contrib/bind9/lib/lwres/man/lwres_context.html +++ b/contrib/bind9/lib/lwres/man/lwres_context.html @@ -1,5 +1,5 @@ - lwres_context - + -
-
+
+

Name

lwres_context_create, lwres_context_destroy, lwres_context_nextserial, lwres_context_initserial, lwres_context_freemem, lwres_context_allocmem, lwres_context_sendrecv — lightweight resolver context management

@@ -31,148 +30,117 @@

Synopsis

#include <lwres/lwres.h>
- +
- - + - - + - - + - - +
lwres_result_t lwres_context_create(lwres_context_t **  -contextp, lwres_context_t **contextp,
 void *  -arg, void *arg,
 lwres_malloc_t   -malloc_function, lwres_malloc_t malloc_function,
 lwres_free_t   -free_function);lwres_free_t free_function);
- +
 
+
- - +
lwres_result_t lwres_context_destroy(lwres_context_t **  -contextp);lwres_context_t **contextp);
- +
 
+
- - + - - +
void lwres_context_initserial(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_uint32_t   -serial);lwres_uint32_t serial);
- +
 
+
- - +
lwres_uint32_t lwres_context_nextserial(lwres_context_t *  -ctx);lwres_context_t *ctx);
- +
 
+
- - + - - + - - +
void lwres_context_freemem(lwres_context_t *  -ctx, lwres_context_t *ctx,
 void *  -mem, void *mem,
 size_t   -len);size_t len);
- +
 
+
- - + - - +
void lwres_context_allocmem(lwres_context_t *  -ctx, lwres_context_t *ctx,
 size_t   -len);size_t len);
- +
 
+
- - + - - + - - + - - + - - + - - +
void * lwres_context_sendrecv(lwres_context_t *  -ctx, lwres_context_t *ctx,
 void *  -sendbase, void *sendbase,
 int   -sendlen, int sendlen,
 void *  -recvbase, void *recvbase,
 int   -recvlen, int recvlen,
 int *  -recvd_len);int *recvd_len);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

lwres_context_create() creates a lwres_context_t structure for use in lightweight resolver operations. It holds a socket and other @@ -257,8 +225,8 @@ void * *recvd_len.

-
-

RETURN VALUES

+
+

RETURN VALUES

lwres_context_create() returns LWRES_R_NOMEMORY if memory for the struct lwres_context could not be allocated, @@ -282,8 +250,8 @@ void * times out waiting for a response.

-
-

SEE ALSO

+
+

SEE ALSO

lwres_conf_init(3), malloc(3), diff --git a/contrib/bind9/lib/lwres/man/lwres_gabn.3 b/contrib/bind9/lib/lwres/man/lwres_gabn.3 index f67126eb5..2e5b8f7b4 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gabn.3 +++ b/contrib/bind9/lib/lwres/man/lwres_gabn.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,69 +13,95 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_gabn .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_GABN" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_GABN" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_gabnrequest_render, lwres_gabnresponse_render, lwres_gabnrequest_parse, lwres_gabnresponse_parse, lwres_gabnresponse_free, lwres_gabnrequest_free \- lightweight resolver getaddrbyname message handling .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 40 +.ft +.HP \w'lwres_result_t\ lwres_gabnrequest_render('u .BI "lwres_result_t lwres_gabnrequest_render(lwres_context_t\ *" "ctx" ", lwres_gabnrequest_t\ *" "req" ", lwres_lwpacket_t\ *" "pkt" ", lwres_buffer_t\ *" "b" ");" -.HP 41 +.HP \w'lwres_result_t\ lwres_gabnresponse_render('u .BI "lwres_result_t lwres_gabnresponse_render(lwres_context_t\ *" "ctx" ", lwres_gabnresponse_t\ *" "req" ", lwres_lwpacket_t\ *" "pkt" ", lwres_buffer_t\ *" "b" ");" -.HP 39 +.HP \w'lwres_result_t\ lwres_gabnrequest_parse('u .BI "lwres_result_t lwres_gabnrequest_parse(lwres_context_t\ *" "ctx" ", lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ", lwres_gabnrequest_t\ **" "structp" ");" -.HP 40 +.HP \w'lwres_result_t\ lwres_gabnresponse_parse('u .BI "lwres_result_t lwres_gabnresponse_parse(lwres_context_t\ *" "ctx" ", lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ", lwres_gabnresponse_t\ **" "structp" ");" -.HP 29 +.HP \w'void\ lwres_gabnresponse_free('u .BI "void lwres_gabnresponse_free(lwres_context_t\ *" "ctx" ", lwres_gabnresponse_t\ **" "structp" ");" -.HP 28 +.HP \w'void\ lwres_gabnrequest_free('u .BI "void lwres_gabnrequest_free(lwres_context_t\ *" "ctx" ", lwres_gabnrequest_t\ **" "structp" ");" .SH "DESCRIPTION" .PP -These are low\-level routines for creating and parsing lightweight resolver name\-to\-address lookup request and response messages. +These are low\-level routines for creating and parsing lightweight resolver name\-to\-address lookup request and response messages\&. .PP -There are four main functions for the getaddrbyname opcode. One render function converts a getaddrbyname request structure \(em +There are four main functions for the getaddrbyname opcode\&. One render function converts a getaddrbyname request structure \(em \fBlwres_gabnrequest_t\fR -\(em to the lightweight resolver's canonical format. It is complemented by a parse function that converts a packet in this canonical format to a getaddrbyname request structure. Another render function converts the getaddrbyname response structure \(em +\(em to the lightweight resolver\*(Aqs canonical format\&. It is complemented by a parse function that converts a packet in this canonical format to a getaddrbyname request structure\&. Another render function converts the getaddrbyname response structure \(em \fBlwres_gabnresponse_t\fR -\(em to the canonical format. This is complemented by a parse function which converts a packet in canonical format to a getaddrbyname response structure. +\(em to the canonical format\&. This is complemented by a parse function which converts a packet in canonical format to a getaddrbyname response structure\&. .PP These structures are defined in -\fI\fR. They are shown below. +\&. They are shown below\&. .PP +.if n \{\ .RS 4 +.\} .nf #define LWRES_OPCODE_GETADDRSBYNAME 0x00010001U .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf typedef struct lwres_addr lwres_addr_t; typedef LWRES_LIST(lwres_addr_t) lwres_addrlist_t; .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf typedef struct { lwres_uint32_t flags; @@ -84,10 +110,13 @@ typedef struct { char *name; } lwres_gabnrequest_t; .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf typedef struct { lwres_uint32_t flags; @@ -102,24 +131,25 @@ typedef struct { size_t baselen; } lwres_gabnresponse_t; .fi +.if n \{\ .RE -.sp +.\} .PP \fBlwres_gabnrequest_render()\fR uses resolver context \fIctx\fR to convert getaddrbyname request structure \fIreq\fR -to canonical format. The packet header structure +to canonical format\&. The packet header structure \fIpkt\fR is initialised and transferred to buffer -\fIb\fR. The contents of +\fIb\fR\&. The contents of \fI*req\fR -are then appended to the buffer in canonical format. +are then appended to the buffer in canonical format\&. \fBlwres_gabnresponse_render()\fR performs the same task, except it converts a getaddrbyname response structure \fBlwres_gabnresponse_t\fR -to the lightweight resolver's canonical format. +to the lightweight resolver\*(Aqs canonical format\&. .PP \fBlwres_gabnrequest_parse()\fR uses context @@ -128,18 +158,18 @@ to convert the contents of packet \fIpkt\fR to a \fBlwres_gabnrequest_t\fR -structure. Buffer +structure\&. Buffer \fIb\fR -provides space to be used for storing this structure. When the function succeeds, the resulting +provides space to be used for storing this structure\&. When the function succeeds, the resulting \fBlwres_gabnrequest_t\fR is made available through -\fI*structp\fR. +\fI*structp\fR\&. \fBlwres_gabnresponse_parse()\fR offers the same semantics as \fBlwres_gabnrequest_parse()\fR except it yields a \fBlwres_gabnresponse_t\fR -structure. +structure\&. .PP \fBlwres_gabnresponse_free()\fR and @@ -151,20 +181,19 @@ that was allocated to the or \fBlwres_gabnrequest_t\fR structures referenced via -\fIstructp\fR. Any memory associated with ancillary buffers and strings for those structures is also discarded. +\fIstructp\fR\&. Any memory associated with ancillary buffers and strings for those structures is also discarded\&. .SH "RETURN VALUES" .PP The getaddrbyname opcode functions \fBlwres_gabnrequest_render()\fR, -\fBlwres_gabnresponse_render()\fR -\fBlwres_gabnrequest_parse()\fR +\fBlwres_gabnresponse_render()\fR\fBlwres_gabnrequest_parse()\fR and \fBlwres_gabnresponse_parse()\fR all return \fBLWRES_R_SUCCESS\fR -on success. They return +on success\&. They return \fBLWRES_R_NOMEMORY\fR -if memory allocation fails. +if memory allocation fails\&. \fBLWRES_R_UNEXPECTEDEND\fR is returned if the available space in the buffer \fIb\fR @@ -172,24 +201,28 @@ is too small to accommodate the packet header or the \fBlwres_gabnrequest_t\fR and \fBlwres_gabnresponse_t\fR -structures. +structures\&. \fBlwres_gabnrequest_parse()\fR and \fBlwres_gabnresponse_parse()\fR will return \fBLWRES_R_UNEXPECTEDEND\fR -if the buffer is not empty after decoding the received packet. These functions will return +if the buffer is not empty after decoding the received packet\&. These functions will return \fBLWRES_R_FAILURE\fR if -pktflags +\fIpktflags\fR in the packet header structure \fBlwres_lwpacket_t\fR -indicate that the packet is not a response to an earlier query. +indicate that the packet is not a response to an earlier query\&. .SH "SEE ALSO" .PP \fBlwres_packet\fR(3) +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_gabn.docbook b/contrib/bind9/lib/lwres/man/lwres_gabn.docbook index 8743696c1..8c6382375 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gabn.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_gabn.docbook @@ -1,8 +1,7 @@ -]> +]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +39,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -109,8 +113,8 @@ void - - DESCRIPTION + DESCRIPTION + These are low-level routines for creating and parsing lightweight resolver name-to-address lookup request and @@ -207,9 +211,9 @@ typedef struct { Any memory associated with ancillary buffers and strings for those structures is also discarded. - - - RETURN VALUES + + RETURN VALUES + The getaddrbyname opcode functions lwres_gabnrequest_render(), @@ -240,21 +244,17 @@ typedef struct { These functions will return LWRES_R_FAILURE if - pktflags + pktflags in the packet header structure lwres_lwpacket_t indicate that the packet is not a response to an earlier query. - - - SEE ALSO + + SEE ALSO + lwres_packet3 - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_gabn.html b/contrib/bind9/lib/lwres/man/lwres_gabn.html index a00f82d3a..949d6d28a 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gabn.html +++ b/contrib/bind9/lib/lwres/man/lwres_gabn.html @@ -1,5 +1,5 @@ - lwres_gabn - + -

-
+
+

Name

lwres_gabnrequest_render, lwres_gabnresponse_render, lwres_gabnrequest_parse, lwres_gabnresponse_parse, lwres_gabnresponse_free, lwres_gabnrequest_free — lightweight resolver getaddrbyname message handling

@@ -31,154 +30,120 @@

Synopsis

#include <lwres/lwres.h>
- +
- - + - - + - - + - - +
lwres_result_t lwres_gabnrequest_render(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_gabnrequest_t *  -req, lwres_gabnrequest_t *req,
 lwres_lwpacket_t *  -pkt, lwres_lwpacket_t *pkt,
 lwres_buffer_t *  -b);lwres_buffer_t *b);
- +
 
+
- - + - - + - - + - - +
lwres_result_t lwres_gabnresponse_render(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_gabnresponse_t *  -req, lwres_gabnresponse_t *req,
 lwres_lwpacket_t *  -pkt, lwres_lwpacket_t *pkt,
 lwres_buffer_t *  -b);lwres_buffer_t *b);
- +
 
+
- - + - - + - - + - - +
lwres_result_t lwres_gabnrequest_parse(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_buffer_t *  -b, lwres_buffer_t *b,
 lwres_lwpacket_t *  -pkt, lwres_lwpacket_t *pkt,
 lwres_gabnrequest_t **  -structp);lwres_gabnrequest_t **structp);
- +
 
+
- - + - - + - - + - - +
lwres_result_t lwres_gabnresponse_parse(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_buffer_t *  -b, lwres_buffer_t *b,
 lwres_lwpacket_t *  -pkt, lwres_lwpacket_t *pkt,
 lwres_gabnresponse_t **  -structp);lwres_gabnresponse_t **structp);
- +
 
+
- - + - - +
void lwres_gabnresponse_free(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_gabnresponse_t **  -structp);lwres_gabnresponse_t **structp);
- +
 
+
- - + - - +
void lwres_gabnrequest_free(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_gabnrequest_t **  -structp);lwres_gabnrequest_t **structp);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

These are low-level routines for creating and parsing lightweight resolver name-to-address lookup request and @@ -277,8 +242,8 @@ typedef struct { those structures is also discarded.

-
-

RETURN VALUES

+
+

RETURN VALUES

The getaddrbyname opcode functions lwres_gabnrequest_render(), @@ -309,14 +274,14 @@ typedef struct { These functions will return LWRES_R_FAILURE if - pktflags + pktflags in the packet header structure lwres_lwpacket_t indicate that the packet is not a response to an earlier query.

-
-

SEE ALSO

+
+

SEE ALSO

lwres_packet(3)

diff --git a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.3 b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.3 index 8da3828f9..feb7c38a9 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.3 +++ b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,36 +13,54 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_gai_strerror .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_GAI_STRERROR" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_GAI_STRERROR" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_gai_strerror \- print suitable error string .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 20 +.ft +.HP \w'char\ *\ gai_strerror('u .BI "char * gai_strerror(int\ " "ecode" ");" .SH "DESCRIPTION" .PP \fBlwres_gai_strerror()\fR returns an error message corresponding to an error code returned by -\fBgetaddrinfo()\fR. The following error codes and their meaning are defined in -\fIinclude/lwres/netdb.h\fR. +\fBgetaddrinfo()\fR\&. The following error codes and their meaning are defined in +include/lwres/netdb\&.h\&. .PP \fBEAI_ADDRFAMILY\fR .RS 4 @@ -106,7 +124,7 @@ The message invalid error code is returned if \fIecode\fR -is out of range. +is out of range\&. .PP \fBai_flags\fR, \fBai_family\fR @@ -115,15 +133,19 @@ and are elements of the \fBstruct addrinfo\fR used by -\fBlwres_getaddrinfo()\fR. +\fBlwres_getaddrinfo()\fR\&. .SH "SEE ALSO" .PP \fBstrerror\fR(3), \fBlwres_getaddrinfo\fR(3), \fBgetaddrinfo\fR(3), -\fBRFC2133\fR(). +\fBRFC2133\fR()\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.docbook b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.docbook index a9314d319..f6e04e7ec 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.docbook @@ -1,8 +1,5 @@ -]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +37,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -62,8 +64,8 @@ char * - - DESCRIPTION + DESCRIPTION + lwres_gai_strerror() returns an error message corresponding to an error code returned by @@ -172,10 +174,10 @@ char * used by lwres_getaddrinfo(). - + + + SEE ALSO - - SEE ALSO strerror3 , @@ -192,9 +194,5 @@ char * RFC2133 . - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.html b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.html index 85d228ec1..ce452128a 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.html +++ b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.html @@ -1,5 +1,5 @@ - lwres_gai_strerror - + -
-
+
+

Name

lwres_gai_strerror — print suitable error string

@@ -31,25 +30,24 @@

Synopsis

#include <lwres/netdb.h>
- +
- - +
char * gai_strerror(int   -ecode);int ecode);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

lwres_gai_strerror() returns an error message corresponding to an error code returned by getaddrinfo(). The following error codes and their meaning are defined in include/lwres/netdb.h.

-
+
EAI_ADDRFAMILY

address family for hostname not supported @@ -109,8 +107,8 @@ char * lwres_getaddrinfo().

-
-

SEE ALSO

+
+

SEE ALSO

strerror(3), lwres_getaddrinfo(3), diff --git a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.3 b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.3 index 88b4beabd..af5454365 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.3 +++ b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,37 +13,54 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_getaddrinfo .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_GETADDRINFO" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_GETADDRINFO" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_getaddrinfo, lwres_freeaddrinfo \- socket address structure to host and service name .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 22 +.ft +.HP \w'int\ lwres_getaddrinfo('u .BI "int lwres_getaddrinfo(const\ char\ *" "hostname" ", const\ char\ *" "servname" ", const\ struct\ addrinfo\ *" "hints" ", struct\ addrinfo\ **" "res" ");" -.HP 24 +.HP \w'void\ lwres_freeaddrinfo('u .BI "void lwres_freeaddrinfo(struct\ addrinfo\ *" "ai" ");" .PP If the operating system does not provide a \fBstruct addrinfo\fR, the following structure is used: .PP -.RS 4 .nf struct addrinfo { int ai_flags; /* AI_PASSIVE, AI_CANONNAME */ @@ -56,7 +73,6 @@ struct addrinfo { struct addrinfo *ai_next; /* next structure in linked list */ }; .fi -.RE .sp .SH "DESCRIPTION" .PP @@ -64,31 +80,31 @@ struct addrinfo { is used to get a list of IP addresses and port numbers for host \fIhostname\fR and service -\fIservname\fR. The function is the lightweight resolver's implementation of +\fIservname\fR\&. The function is the lightweight resolver\*(Aqs implementation of \fBgetaddrinfo()\fR -as defined in RFC2133. +as defined in RFC2133\&. \fIhostname\fR and \fIservname\fR are pointers to null\-terminated strings or -\fBNULL\fR. +\fBNULL\fR\&. \fIhostname\fR -is either a host name or a numeric host address string: a dotted decimal IPv4 address or an IPv6 address. +is either a host name or a numeric host address string: a dotted decimal IPv4 address or an IPv6 address\&. \fIservname\fR is either a decimal port number or a service name as listed in -\fI/etc/services\fR. +/etc/services\&. .PP \fIhints\fR is an optional pointer to a -\fBstruct addrinfo\fR. This structure can be used to provide hints concerning the type of socket that the caller supports or wishes to use. The caller can supply the following structure elements in +\fBstruct addrinfo\fR\&. This structure can be used to provide hints concerning the type of socket that the caller supports or wishes to use\&. The caller can supply the following structure elements in \fI*hints\fR: .PP \fBai_family\fR .RS 4 -The protocol family that should be used. When +The protocol family that should be used\&. When \fBai_family\fR is set to -\fBPF_UNSPEC\fR, it means the caller will accept any protocol family supported by the operating system. +\fBPF_UNSPEC\fR, it means the caller will accept any protocol family supported by the operating system\&. .RE .PP \fBai_socktype\fR @@ -98,21 +114,21 @@ denotes the type of socket \(em \fBSOCK_DGRAM\fR or \fBSOCK_RAW\fR -\(em that is wanted. When +\(em that is wanted\&. When \fBai_socktype\fR -is zero the caller will accept any socket type. +is zero the caller will accept any socket type\&. .RE .PP \fBai_protocol\fR .RS 4 -indicates which transport protocol is wanted: IPPROTO_UDP or IPPROTO_TCP. If +indicates which transport protocol is wanted: IPPROTO_UDP or IPPROTO_TCP\&. If \fBai_protocol\fR -is zero the caller will accept any protocol. +is zero the caller will accept any protocol\&. .RE .PP \fBai_flags\fR .RS 4 -Flag bits. If the +Flag bits\&. If the \fBAI_CANONNAME\fR bit is set, a successful call to \fBlwres_getaddrinfo()\fR @@ -120,16 +136,16 @@ will return a null\-terminated string containing the canonical name of the speci \fBai_canonname\fR of the first \fBaddrinfo\fR -structure returned. Setting the +structure returned\&. Setting the \fBAI_PASSIVE\fR bit indicates that the returned socket address structure is intended for used in a call to -\fBbind\fR(2). In this case, if the hostname argument is a +\fBbind\fR(2)\&. In this case, if the hostname argument is a \fBNULL\fR pointer, then the IP address portion of the socket address structure will be set to \fBINADDR_ANY\fR for an IPv4 address or \fBIN6ADDR_ANY_INIT\fR -for an IPv6 address. +for an IPv6 address\&. .sp When \fBai_flags\fR @@ -141,14 +157,14 @@ for a connection\-oriented protocol or \fBconnect\fR(2), \fBsendto\fR(2), or \fBsendmsg\fR(2) -if a connectionless protocol was chosen. The IP address portion of the socket address structure will be set to the loopback address if +if a connectionless protocol was chosen\&. The IP address portion of the socket address structure will be set to the loopback address if \fIhostname\fR is a \fBNULL\fR pointer and \fBAI_PASSIVE\fR is not set in -\fBai_flags\fR. +\fBai_flags\fR\&. .sp If \fBai_flags\fR @@ -156,14 +172,14 @@ is set to \fBAI_NUMERICHOST\fR it indicates that \fIhostname\fR -should be treated as a numeric string defining an IPv4 or IPv6 address and no name resolution should be attempted. +should be treated as a numeric string defining an IPv4 or IPv6 address and no name resolution should be attempted\&. .RE .PP All other elements of the \fBstruct addrinfo\fR passed via \fIhints\fR -must be zero. +must be zero\&. .PP A \fIhints\fR @@ -173,59 +189,58 @@ is treated as if the caller provided a \fBstruct addrinfo\fR initialized to zero with \fBai_family\fRset to -\fBPF_UNSPEC\fR. +\fBPF_UNSPEC\fR\&. .PP After a successful call to \fBlwres_getaddrinfo()\fR, \fI*res\fR is a pointer to a linked list of one or more \fBaddrinfo\fR -structures. Each +structures\&. Each \fBstruct addrinfo\fR in this list cn be processed by following the \fBai_next\fR pointer, until a \fBNULL\fR -pointer is encountered. The three members +pointer is encountered\&. The three members \fBai_family\fR, \fBai_socktype\fR, and \fBai_protocol\fR in each returned \fBaddrinfo\fR structure contain the corresponding arguments for a call to -\fBsocket\fR(2). For each +\fBsocket\fR(2)\&. For each \fBaddrinfo\fR structure in the list, the \fBai_addr\fR member points to a filled\-in socket address structure of length -\fBai_addrlen\fR. +\fBai_addrlen\fR\&. .PP All of the information returned by \fBlwres_getaddrinfo()\fR is dynamically allocated: the addrinfo structures, and the socket address structures and canonical host name strings pointed to by the -\fBaddrinfo\fRstructures. Memory allocated for the dynamically allocated structures created by a successful call to +\fBaddrinfo\fRstructures\&. Memory allocated for the dynamically allocated structures created by a successful call to \fBlwres_getaddrinfo()\fR is released by -\fBlwres_freeaddrinfo()\fR. +\fBlwres_freeaddrinfo()\fR\&. \fIai\fR is a pointer to a \fBstruct addrinfo\fR created by a call to -\fBlwres_getaddrinfo()\fR. +\fBlwres_getaddrinfo()\fR\&. .SH "RETURN VALUES" .PP \fBlwres_getaddrinfo()\fR returns zero on success or one of the error codes listed in \fBgai_strerror\fR(3) -if an error occurs. If both +if an error occurs\&. If both \fIhostname\fR and \fIservname\fR are -\fBNULL\fR -\fBlwres_getaddrinfo()\fR +\fBNULL\fR\fBlwres_getaddrinfo()\fR returns -\fBEAI_NONAME\fR. +\fBEAI_NONAME\fR\&. .SH "SEE ALSO" .PP \fBlwres\fR(3), @@ -238,9 +253,13 @@ returns \fBconnect\fR(2), \fBsendto\fR(2), \fBsendmsg\fR(2), -\fBsocket\fR(2). +\fBsocket\fR(2)\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001, 2003 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.docbook b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.docbook index 76927fd82..2517b1597 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.docbook @@ -1,8 +1,7 @@ -]> +]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +39,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -92,8 +96,8 @@ struct addrinfo { - - DESCRIPTION + DESCRIPTION + lwres_getaddrinfo() is used to get a list of IP addresses and port numbers for host @@ -316,10 +320,10 @@ struct addrinfo { lwres_getaddrinfo(). - + + + RETURN VALUES - - RETURN VALUES lwres_getaddrinfo() returns zero on success or one of the error codes listed in @@ -331,9 +335,9 @@ struct addrinfo { lwres_getaddrinfo() returns EAI_NONAME. - - - SEE ALSO + + SEE ALSO + lwres3 , @@ -379,9 +383,5 @@ struct addrinfo { . - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.html b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.html index b4845f56b..b65488464 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.html +++ b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.html @@ -1,5 +1,5 @@ - lwres_getaddrinfo - + -

-
+
+

Name

lwres_getaddrinfo, lwres_freeaddrinfo — socket address structure to host and service name

@@ -31,42 +30,34 @@

Synopsis

#include <lwres/netdb.h>
- +
- - + - - + - - + - - +
int lwres_getaddrinfo(const char *  -hostname, const char *hostname,
 const char *  -servname, const char *servname,
 const struct addrinfo *  -hints, const struct addrinfo *hints,
 struct addrinfo **  -res);struct addrinfo **res);
- +
 
+
- - +
void lwres_freeaddrinfo(struct addrinfo *  -ai);struct addrinfo *ai);
+
 

If the operating system does not provide a @@ -88,8 +79,8 @@ struct addrinfo {

-
-

DESCRIPTION

+
+

DESCRIPTION

lwres_getaddrinfo() is used to get a list of IP addresses and port numbers for host hostname and service @@ -117,7 +108,7 @@ struct addrinfo { *hints:

-
+
ai_family

The protocol family that should be used. @@ -282,8 +273,8 @@ struct addrinfo { lwres_getaddrinfo().

-
-

RETURN VALUES

+
+

RETURN VALUES

lwres_getaddrinfo() returns zero on success or one of the error codes listed in gai_strerror(3) @@ -293,8 +284,8 @@ struct addrinfo { EAI_NONAME.

-
-

SEE ALSO

+
+

SEE ALSO

lwres(3), lwres_getaddrinfo(3), diff --git a/contrib/bind9/lib/lwres/man/lwres_gethostent.3 b/contrib/bind9/lib/lwres/man/lwres_gethostent.3 index e53aa33c1..36e249431 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gethostent.3 +++ b/contrib/bind9/lib/lwres/man/lwres_gethostent.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,60 +13,80 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_gethostent .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_GETHOSTENT" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_GETHOSTENT" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_gethostbyname, lwres_gethostbyname2, lwres_gethostbyaddr, lwres_gethostent, lwres_sethostent, lwres_endhostent, lwres_gethostbyname_r, lwres_gethostbyaddr_r, lwres_gethostent_r, lwres_sethostent_r, lwres_endhostent_r \- lightweight resolver get network host entry .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 37 +.ft +.HP \w'struct\ hostent\ *\ lwres_gethostbyname('u .BI "struct hostent * lwres_gethostbyname(const\ char\ *" "name" ");" -.HP 38 +.HP \w'struct\ hostent\ *\ lwres_gethostbyname2('u .BI "struct hostent * lwres_gethostbyname2(const\ char\ *" "name" ", int\ " "af" ");" -.HP 37 +.HP \w'struct\ hostent\ *\ lwres_gethostbyaddr('u .BI "struct hostent * lwres_gethostbyaddr(const\ char\ *" "addr" ", int\ " "len" ", int\ " "type" ");" -.HP 34 +.HP \w'struct\ hostent\ *\ lwres_gethostent('u .BI "struct hostent * lwres_gethostent(void);" -.HP 22 +.HP \w'void\ lwres_sethostent('u .BI "void lwres_sethostent(int\ " "stayopen" ");" -.HP 22 +.HP \w'void\ lwres_endhostent('u .BI "void lwres_endhostent(void);" -.HP 39 +.HP \w'struct\ hostent\ *\ lwres_gethostbyname_r('u .BI "struct hostent * lwres_gethostbyname_r(const\ char\ *" "name" ", struct\ hostent\ *" "resbuf" ", char\ *" "buf" ", int\ " "buflen" ", int\ *" "error" ");" -.HP 39 +.HP \w'struct\ hostent\ *\ lwres_gethostbyaddr_r('u .BI "struct hostent * lwres_gethostbyaddr_r(const\ char\ *" "addr" ", int\ " "len" ", int\ " "type" ", struct\ hostent\ *" "resbuf" ", char\ *" "buf" ", int\ " "buflen" ", int\ *" "error" ");" -.HP 36 +.HP \w'struct\ hostent\ *\ lwres_gethostent_r('u .BI "struct hostent * lwres_gethostent_r(struct\ hostent\ *" "resbuf" ", char\ *" "buf" ", int\ " "buflen" ", int\ *" "error" ");" -.HP 24 +.HP \w'void\ lwres_sethostent_r('u .BI "void lwres_sethostent_r(int\ " "stayopen" ");" -.HP 24 +.HP \w'void\ lwres_endhostent_r('u .BI "void lwres_endhostent_r(void);" .SH "DESCRIPTION" .PP -These functions provide hostname\-to\-address and address\-to\-hostname lookups by means of the lightweight resolver. They are similar to the standard +These functions provide hostname\-to\-address and address\-to\-hostname lookups by means of the lightweight resolver\&. They are similar to the standard \fBgethostent\fR(3) -functions provided by most operating systems. They use a +functions provided by most operating systems\&. They use a \fBstruct hostent\fR which is usually defined in -\fI\fR. +\&. .PP +.if n \{\ .RS 4 +.\} .nf struct hostent { char *h_name; /* official name of host */ @@ -77,19 +97,20 @@ struct hostent { }; #define h_addr h_addr_list[0] /* address, for backward compatibility */ .fi +.if n \{\ .RE -.sp +.\} .PP The members of this structure are: .PP \fBh_name\fR .RS 4 -The official (canonical) name of the host. +The official (canonical) name of the host\&. .RE .PP \fBh_aliases\fR .RS 4 -A NULL\-terminated array of alternate names (nicknames) for the host. +A NULL\-terminated array of alternate names (nicknames) for the host\&. .RE .PP \fBh_addrtype\fR @@ -97,25 +118,25 @@ A NULL\-terminated array of alternate names (nicknames) for the host. The type of address being returned \(em \fBPF_INET\fR or -\fBPF_INET6\fR. +\fBPF_INET6\fR\&. .RE .PP \fBh_length\fR .RS 4 -The length of the address in bytes. +The length of the address in bytes\&. .RE .PP \fBh_addr_list\fR .RS 4 A \fBNULL\fR -terminated array of network addresses for the host. Host addresses are returned in network byte order. +terminated array of network addresses for the host\&. Host addresses are returned in network byte order\&. .RE .PP For backward compatibility with very old software, \fBh_addr\fR is the first address in -\fBh_addr_list.\fR +\fBh_addr_list\&.\fR .PP \fBlwres_gethostent()\fR, \fBlwres_sethostent()\fR, @@ -125,14 +146,14 @@ is the first address in and \fBlwres_endhostent_r()\fR provide iteration over the known host entries on systems that provide such functionality through facilities like -\fI/etc/hosts\fR -or NIS. The lightweight resolver does not currently implement these functions; it only provides them as stub functions that always return failure. +/etc/hosts +or NIS\&. The lightweight resolver does not currently implement these functions; it only provides them as stub functions that always return failure\&. .PP \fBlwres_gethostbyname()\fR and \fBlwres_gethostbyname2()\fR look up the hostname -\fIname\fR. +\fIname\fR\&. \fBlwres_gethostbyname()\fR always looks for an IPv4 address while \fBlwres_gethostbyname2()\fR @@ -141,17 +162,17 @@ looks for an address of protocol family \fBPF_INET\fR or \fBPF_INET6\fR -\(em IPv4 or IPV6 addresses respectively. Successful calls of the functions return a -\fBstruct hostent\fRfor the name that was looked up. +\(em IPv4 or IPV6 addresses respectively\&. Successful calls of the functions return a +\fBstruct hostent\fRfor the name that was looked up\&. \fBNULL\fR is returned if the lookups by \fBlwres_gethostbyname()\fR or \fBlwres_gethostbyname2()\fR -fail. +fail\&. .PP Reverse lookups of addresses are performed by -\fBlwres_gethostbyaddr()\fR. +\fBlwres_gethostbyaddr()\fR\&. \fIaddr\fR is an address of length \fIlen\fR @@ -160,15 +181,15 @@ bytes and protocol family \(em \fBPF_INET\fR or -\fBPF_INET6\fR. +\fBPF_INET6\fR\&. \fBlwres_gethostbyname_r()\fR -is a thread\-safe function for forward lookups. If an error occurs, an error code is returned in -\fI*error\fR. +is a thread\-safe function for forward lookups\&. If an error occurs, an error code is returned in +\fI*error\fR\&. \fIresbuf\fR is a pointer to a \fBstruct hostent\fR which is initialised by a successful call to -\fBlwres_gethostbyname_r()\fR. +\fBlwres_gethostbyname_r()\fR\&. \fIbuf\fR is a buffer of length \fIlen\fR @@ -179,12 +200,12 @@ bytes which is used to store the elements of the \fBstruct hostent\fR returned in -\fIresbuf\fR. Successful calls to +\fIresbuf\fR\&. Successful calls to \fBlwres_gethostbyname_r()\fR return \fIresbuf\fR, which is a pointer to the \fBstruct hostent\fR -it created. +it created\&. .PP \fBlwres_gethostbyaddr_r()\fR is a thread\-safe function that performs a reverse lookup of address @@ -196,14 +217,14 @@ bytes long and is of protocol family \(em \fBPF_INET\fR or -\fBPF_INET6\fR. If an error occurs, the error code is returned in -\fI*error\fR. The other function parameters are identical to those in -\fBlwres_gethostbyname_r()\fR. +\fBPF_INET6\fR\&. If an error occurs, the error code is returned in +\fI*error\fR\&. The other function parameters are identical to those in +\fBlwres_gethostbyname_r()\fR\&. \fIresbuf\fR is a pointer to a \fBstruct hostent\fR which is initialised by a successful call to -\fBlwres_gethostbyaddr_r()\fR. +\fBlwres_gethostbyaddr_r()\fR\&. \fIbuf\fR is a buffer of length \fIlen\fR @@ -214,12 +235,12 @@ bytes which is used to store the elements of the \fBstruct hostent\fR returned in -\fIresbuf\fR. Successful calls to +\fIresbuf\fR\&. Successful calls to \fBlwres_gethostbyaddr_r()\fR return \fIresbuf\fR, which is a pointer to the \fBstruct hostent()\fR -it created. +it created\&. .SH "RETURN VALUES" .PP The functions @@ -227,39 +248,39 @@ The functions \fBlwres_gethostbyname2()\fR, \fBlwres_gethostbyaddr()\fR, and \fBlwres_gethostent()\fR -return NULL to indicate an error. In this case the global variable +return NULL to indicate an error\&. In this case the global variable \fBlwres_h_errno\fR will contain one of the following error codes defined in -\fI\fR: +: .PP \fBHOST_NOT_FOUND\fR .RS 4 -The host or address was not found. +The host or address was not found\&. .RE .PP \fBTRY_AGAIN\fR .RS 4 -A recoverable error occurred, e.g., a timeout. Retrying the lookup may succeed. +A recoverable error occurred, e\&.g\&., a timeout\&. Retrying the lookup may succeed\&. .RE .PP \fBNO_RECOVERY\fR .RS 4 -A non\-recoverable error occurred. +A non\-recoverable error occurred\&. .RE .PP \fBNO_DATA\fR .RS 4 -The name exists, but has no address information associated with it (or vice versa in the case of a reverse lookup). The code NO_ADDRESS is accepted as a synonym for NO_DATA for backwards compatibility. +The name exists, but has no address information associated with it (or vice versa in the case of a reverse lookup)\&. The code NO_ADDRESS is accepted as a synonym for NO_DATA for backwards compatibility\&. .RE .PP \fBlwres_hstrerror\fR(3) -translates these error codes to suitable error messages. +translates these error codes to suitable error messages\&. .PP \fBlwres_gethostent()\fR and \fBlwres_gethostent_r()\fR always return -\fBNULL\fR. +\fBNULL\fR\&. .PP Successful calls to \fBlwres_gethostbyname_r()\fR @@ -268,7 +289,7 @@ and return \fIresbuf\fR, a pointer to the \fBstruct hostent\fR -that was initialised by these functions. They return +that was initialised by these functions\&. They return \fBNULL\fR if the lookups fail or if \fIbuf\fR @@ -277,7 +298,7 @@ was too small to hold the list of addresses and names referenced by the \fBh_aliases\fR, and \fBh_addr_list\fR elements of the -\fBstruct hostent\fR. If +\fBstruct hostent\fR\&. If \fIbuf\fR was too small, both \fBlwres_gethostbyname_r()\fR @@ -286,7 +307,7 @@ and set the global variable \fBerrno\fR to -\fBERANGE\fR. +\fBERANGE\fR\&. .SH "SEE ALSO" .PP \fBgethostent\fR(3), @@ -299,17 +320,21 @@ to \fBlwres_gethostbyaddr()\fR and \fBlwres_endhostent()\fR -are not thread safe; they return pointers to static data and provide error codes through a global variable. Thread\-safe versions for name and address lookup are provided by +are not thread safe; they return pointers to static data and provide error codes through a global variable\&. Thread\-safe versions for name and address lookup are provided by \fBlwres_gethostbyname_r()\fR, and \fBlwres_gethostbyaddr_r()\fR -respectively. +respectively\&. .PP The resolver daemon does not currently support any non\-DNS name services such as -\fI/etc/hosts\fR +/etc/hosts or -\fBNIS\fR, consequently the above functions don't, either. +\fBNIS\fR, consequently the above functions don\*(Aqt, either\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_gethostent.docbook b/contrib/bind9/lib/lwres/man/lwres_gethostent.docbook index 487fb7f9e..cf68feb21 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gethostent.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_gethostent.docbook @@ -1,8 +1,7 @@ -]> +]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +39,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -146,8 +150,8 @@ void - - DESCRIPTION + DESCRIPTION + These functions provide hostname-to-address and address-to-hostname lookups by means of the lightweight resolver. @@ -306,10 +310,10 @@ struct hostent { struct hostent() it created. - + + + RETURN VALUES - - RETURN VALUES The functions lwres_gethostbyname(), @@ -391,9 +395,9 @@ struct hostent { errno to ERANGE. - - - SEE ALSO + + SEE ALSO + gethostent3 , @@ -406,10 +410,10 @@ struct hostent { lwres_hstrerror3 - + + + BUGS - - BUGS lwres_gethostbyname(), lwres_gethostbyname2(), lwres_gethostbyaddr() @@ -431,9 +435,5 @@ struct hostent { NIS, consequently the above functions don't, either. - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_gethostent.html b/contrib/bind9/lib/lwres/man/lwres_gethostent.html index 3435f1c18..ef0a5f382 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gethostent.html +++ b/contrib/bind9/lib/lwres/man/lwres_gethostent.html @@ -1,5 +1,5 @@ - lwres_gethostent - + -

-
+
+

Name

lwres_gethostbyname, lwres_gethostbyname2, lwres_gethostbyaddr, lwres_gethostent, lwres_sethostent, lwres_endhostent, lwres_gethostbyname_r, lwres_gethostbyaddr_r, lwres_gethostent_r, lwres_sethostent_r, lwres_endhostent_r — lightweight resolver get network host entry

@@ -31,204 +30,161 @@

Synopsis

#include <lwres/netdb.h>
- +
- - +
struct hostent * lwres_gethostbyname(const char *  -name);const char *name);
- +
 
+
- - + - - +
struct hostent * lwres_gethostbyname2(const char *  -name, const char *name,
 int   -af);int af);
- +
 
+
- - + - - + - - +
struct hostent * lwres_gethostbyaddr(const char *  -addr, const char *addr,
 int   -len, int len,
 int   -type);int type);
- +
 
+
- - +
struct hostent * lwres_gethostent(  -);void);
- +
 
+
- - +
void lwres_sethostent(int   -stayopen);int stayopen);
- +
 
+
- - +
void lwres_endhostent(  -);void);
- +
 
+
- - + - - + - - + - - + - - +
struct hostent * lwres_gethostbyname_r(const char *  -name, const char *name,
 struct hostent *  -resbuf, struct hostent *resbuf,
 char *  -buf, char *buf,
 int   -buflen, int buflen,
 int *  -error);int *error);
- +
 
+
- - + - - + - - + - - + - - + - - + - - +
struct hostent * lwres_gethostbyaddr_r(const char *  -addr, const char *addr,
 int   -len, int len,
 int   -type, int type,
 struct hostent *  -resbuf, struct hostent *resbuf,
 char *  -buf, char *buf,
 int   -buflen, int buflen,
 int *  -error);int *error);
- +
 
+
- - + - - + - - + - - +
struct hostent * lwres_gethostent_r(struct hostent *  -resbuf, struct hostent *resbuf,
 char *  -buf, char *buf,
 int   -buflen, int buflen,
 int *  -error);int *error);
- +
 
+
- - +
void lwres_sethostent_r(int   -stayopen);int stayopen);
- +
 
+
- - +
void lwres_endhostent_r(  -);void);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

These functions provide hostname-to-address and address-to-hostname lookups by means of the lightweight resolver. @@ -255,7 +211,7 @@ struct hostent {

The members of this structure are:

-
+
h_name

The official (canonical) name of the host. @@ -365,8 +321,8 @@ struct hostent { struct hostent() it created.

-
-

RETURN VALUES

+
+

RETURN VALUES

The functions lwres_gethostbyname(), @@ -380,7 +336,7 @@ struct hostent { <lwres/netdb.h>:

-
+
HOST_NOT_FOUND

The host or address was not found. @@ -429,8 +385,8 @@ struct hostent { errno to ERANGE.

-
-

SEE ALSO

+
+

SEE ALSO

gethostent(3), lwres_getipnode(3), @@ -438,8 +394,8 @@ struct hostent { lwres_hstrerror(3)

-
-

BUGS

+
+

BUGS

lwres_gethostbyname(), lwres_gethostbyname2(), lwres_gethostbyaddr() diff --git a/contrib/bind9/lib/lwres/man/lwres_getipnode.3 b/contrib/bind9/lib/lwres/man/lwres_getipnode.3 index 4eb58cc2b..ab8f0b5a6 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getipnode.3 +++ b/contrib/bind9/lib/lwres/man/lwres_getipnode.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,44 +13,64 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_getipnode .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_GETIPNODE" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_GETIPNODE" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_getipnodebyname, lwres_getipnodebyaddr, lwres_freehostent \- lightweight resolver nodename / address translation API .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 39 +.ft +.HP \w'struct\ hostent\ *\ lwres_getipnodebyname('u .BI "struct hostent * lwres_getipnodebyname(const\ char\ *" "name" ", int\ " "af" ", int\ " "flags" ", int\ *" "error_num" ");" -.HP 39 +.HP \w'struct\ hostent\ *\ lwres_getipnodebyaddr('u .BI "struct hostent * lwres_getipnodebyaddr(const\ void\ *" "src" ", size_t\ " "len" ", int\ " "af" ", int\ *" "error_num" ");" -.HP 23 +.HP \w'void\ lwres_freehostent('u .BI "void lwres_freehostent(struct\ hostent\ *" "he" ");" .SH "DESCRIPTION" .PP -These functions perform thread safe, protocol independent nodename\-to\-address and address\-to\-nodename translation as defined in RFC2553. +These functions perform thread safe, protocol independent nodename\-to\-address and address\-to\-nodename translation as defined in RFC2553\&. .PP They use a \fBstruct hostent\fR which is defined in -\fInamedb.h\fR: +namedb\&.h: .PP +.if n \{\ .RS 4 +.\} .nf struct hostent { char *h_name; /* official name of host */ @@ -61,19 +81,20 @@ struct hostent { }; #define h_addr h_addr_list[0] /* address, for backward compatibility */ .fi +.if n \{\ .RE -.sp +.\} .PP The members of this structure are: .PP \fBh_name\fR .RS 4 -The official (canonical) name of the host. +The official (canonical) name of the host\&. .RE .PP \fBh_aliases\fR .RS 4 -A NULL\-terminated array of alternate names (nicknames) for the host. +A NULL\-terminated array of alternate names (nicknames) for the host\&. .RE .PP \fBh_addrtype\fR @@ -81,46 +102,46 @@ A NULL\-terminated array of alternate names (nicknames) for the host. The type of address being returned \- usually \fBPF_INET\fR or -\fBPF_INET6\fR. +\fBPF_INET6\fR\&. .RE .PP \fBh_length\fR .RS 4 -The length of the address in bytes. +The length of the address in bytes\&. .RE .PP \fBh_addr_list\fR .RS 4 A \fBNULL\fR -terminated array of network addresses for the host. Host addresses are returned in network byte order. +terminated array of network addresses for the host\&. Host addresses are returned in network byte order\&. .RE .PP \fBlwres_getipnodebyname()\fR looks up addresses of protocol family \fIaf\fR for the hostname -\fIname\fR. The +\fIname\fR\&. The \fIflags\fR -parameter contains ORed flag bits to specify the types of addresses that are searched for, and the types of addresses that are returned. The flag bits are: +parameter contains ORed flag bits to specify the types of addresses that are searched for, and the types of addresses that are returned\&. The flag bits are: .PP \fBAI_V4MAPPED\fR .RS 4 This is used with an \fIaf\fR -of AF_INET6, and causes IPv4 addresses to be returned as IPv4\-mapped IPv6 addresses. +of AF_INET6, and causes IPv4 addresses to be returned as IPv4\-mapped IPv6 addresses\&. .RE .PP \fBAI_ALL\fR .RS 4 This is used with an \fIaf\fR -of AF_INET6, and causes all known addresses (IPv6 and IPv4) to be returned. If AI_V4MAPPED is also set, the IPv4 addresses are return as mapped IPv6 addresses. +of AF_INET6, and causes all known addresses (IPv6 and IPv4) to be returned\&. If AI_V4MAPPED is also set, the IPv4 addresses are return as mapped IPv6 addresses\&. .RE .PP \fBAI_ADDRCONFIG\fR .RS 4 -Only return an IPv6 or IPv4 address if here is an active network interface of that type. This is not currently implemented in the BIND 9 lightweight resolver, and the flag is ignored. +Only return an IPv6 or IPv4 address if here is an active network interface of that type\&. This is not currently implemented in the BIND 9 lightweight resolver, and the flag is ignored\&. .RE .PP \fBAI_DEFAULT\fR @@ -129,7 +150,7 @@ This default sets the \fBAI_V4MAPPED\fR and \fBAI_ADDRCONFIG\fR -flag bits. +flag bits\&. .RE .PP \fBlwres_getipnodebyaddr()\fR @@ -137,25 +158,25 @@ performs a reverse lookup of address \fIsrc\fR which is \fIlen\fR -bytes long. +bytes long\&. \fIaf\fR denotes the protocol family, typically \fBPF_INET\fR or -\fBPF_INET6\fR. +\fBPF_INET6\fR\&. .PP \fBlwres_freehostent()\fR releases all the memory associated with the \fBstruct hostent\fR pointer -\fIhe\fR. Any memory allocated for the +\fIhe\fR\&. Any memory allocated for the \fBh_name\fR, \fBh_addr_list\fR and \fBh_aliases\fR is freed, as is the memory for the \fBhostent\fR -structure itself. +structure itself\&. .SH "RETURN VALUES" .PP If an error occurs, @@ -166,31 +187,31 @@ set \fI*error_num\fR to an appropriate error code and the function returns a \fBNULL\fR -pointer. The error codes and their meanings are defined in -\fI\fR: +pointer\&. The error codes and their meanings are defined in +: .PP \fBHOST_NOT_FOUND\fR .RS 4 -No such host is known. +No such host is known\&. .RE .PP \fBNO_ADDRESS\fR .RS 4 -The server recognised the request and the name but no address is available. Another type of request to the name server for the domain might return an answer. +The server recognised the request and the name but no address is available\&. Another type of request to the name server for the domain might return an answer\&. .RE .PP \fBTRY_AGAIN\fR .RS 4 -A temporary and possibly transient error occurred, such as a failure of a server to respond. The request may succeed if retried. +A temporary and possibly transient error occurred, such as a failure of a server to respond\&. The request may succeed if retried\&. .RE .PP \fBNO_RECOVERY\fR .RS 4 -An unexpected failure occurred, and retrying the request is pointless. +An unexpected failure occurred, and retrying the request is pointless\&. .RE .PP \fBlwres_hstrerror\fR(3) -translates these error codes to suitable error messages. +translates these error codes to suitable error messages\&. .SH "SEE ALSO" .PP \fBRFC2553\fR(), @@ -198,9 +219,13 @@ translates these error codes to suitable error messages. \fBlwres_gethostent\fR(3), \fBlwres_getaddrinfo\fR(3), \fBlwres_getnameinfo\fR(3), -\fBlwres_hstrerror\fR(3). +\fBlwres_hstrerror\fR(3)\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001, 2003 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_getipnode.docbook b/contrib/bind9/lib/lwres/man/lwres_getipnode.docbook index 44b628b55..14e14aaa3 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getipnode.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_getipnode.docbook @@ -1,8 +1,5 @@ -]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +37,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -82,8 +84,8 @@ void - - DESCRIPTION + DESCRIPTION + These functions perform thread safe, protocol independent @@ -236,9 +238,9 @@ struct hostent { h_aliases is freed, as is the memory for the hostent structure itself. - - - RETURN VALUES + + RETURN VALUES + If an error occurs, lwres_getipnodebyname() @@ -296,9 +298,9 @@ struct hostent { translates these error codes to suitable error messages. - - - SEE ALSO + + SEE ALSO + RFC2553 , @@ -323,9 +325,5 @@ struct hostent { lwres_hstrerror3 . - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_getipnode.html b/contrib/bind9/lib/lwres/man/lwres_getipnode.html index 6fe0ec647..a27b3994c 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getipnode.html +++ b/contrib/bind9/lib/lwres/man/lwres_getipnode.html @@ -1,5 +1,5 @@ - lwres_getipnode - + -

-
+
+

Name

lwres_getipnodebyname, lwres_getipnodebyaddr, lwres_freehostent — lightweight resolver nodename / address translation API

@@ -31,74 +30,59 @@

Synopsis

#include <lwres/netdb.h>
- +
- - + - - + - - + - - +
struct hostent * lwres_getipnodebyname(const char *  -name, const char *name,
 int   -af, int af,
 int   -flags, int flags,
 int *  -error_num);int *error_num);
- +
 
+
- - + - - + - - + - - +
struct hostent * lwres_getipnodebyaddr(const void *  -src, const void *src,
 size_t   -len, size_t len,
 int   -af, int af,
 int *  -error_num);int *error_num);
- +
 
+
- - +
void lwres_freehostent(struct hostent *  -he);struct hostent *he);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

These functions perform thread safe, protocol independent nodename-to-address and address-to-nodename @@ -125,7 +109,7 @@ struct hostent {

The members of this structure are:

-
+
h_name

The official (canonical) name of the host. @@ -165,7 +149,7 @@ struct hostent { types of addresses that are returned. The flag bits are:

-
+
AI_V4MAPPED

This is used with an @@ -216,8 +200,8 @@ struct hostent { the hostent structure itself.

-
-

RETURN VALUES

+
+

RETURN VALUES

If an error occurs, lwres_getipnodebyname() @@ -231,7 +215,7 @@ struct hostent { The error codes and their meanings are defined in <lwres/netdb.h>:

-
+
HOST_NOT_FOUND

No such host is known. @@ -260,8 +244,8 @@ struct hostent { translates these error codes to suitable error messages.

-
-

SEE ALSO

+
+

SEE ALSO

RFC2553, lwres(3), diff --git a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.3 b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.3 index 993b17214..c0c4ff4cf 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.3 +++ b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,57 +13,74 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_getnameinfo .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_GETNAMEINFO" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_GETNAMEINFO" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_getnameinfo \- lightweight resolver socket address structure to hostname and service name .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 22 +.ft +.HP \w'int\ lwres_getnameinfo('u .BI "int lwres_getnameinfo(const\ struct\ sockaddr\ *" "sa" ", size_t\ " "salen" ", char\ *" "host" ", size_t\ " "hostlen" ", char\ *" "serv" ", size_t\ " "servlen" ", int\ " "flags" ");" .SH "DESCRIPTION" .PP This function is equivalent to the \fBgetnameinfo\fR(3) -function defined in RFC2133. +function defined in RFC2133\&. \fBlwres_getnameinfo()\fR returns the hostname for the -\fBstruct sockaddr\fR -\fIsa\fR +\fBstruct sockaddr\fR\fIsa\fR which is \fIsalen\fR -bytes long. The hostname is of length +bytes long\&. The hostname is of length \fIhostlen\fR and is returned via -\fI*host.\fR +\fI*host\&.\fR The maximum length of the hostname is 1025 bytes: -\fBNI_MAXHOST\fR. +\fBNI_MAXHOST\fR\&. .PP The name of the service associated with the port number in \fIsa\fR is returned in -\fI*serv.\fR +\fI*serv\&.\fR It is \fIservlen\fR -bytes long. The maximum length of the service name is +bytes long\&. The maximum length of the service name is \fBNI_MAXSERV\fR -\- 32 bytes. +\- 32 bytes\&. .PP The \fIflags\fR @@ -71,47 +88,51 @@ argument sets the following bits: .PP \fBNI_NOFQDN\fR .RS 4 -A fully qualified domain name is not required for local hosts. The local part of the fully qualified domain name is returned instead. +A fully qualified domain name is not required for local hosts\&. The local part of the fully qualified domain name is returned instead\&. .RE .PP \fBNI_NUMERICHOST\fR .RS 4 -Return the address in numeric form, as if calling inet_ntop(), instead of a host name. +Return the address in numeric form, as if calling inet_ntop(), instead of a host name\&. .RE .PP \fBNI_NAMEREQD\fR .RS 4 -A name is required. If the hostname cannot be found in the DNS and this flag is set, a non\-zero error code is returned. If the hostname is not found and the flag is not set, the address is returned in numeric form. +A name is required\&. If the hostname cannot be found in the DNS and this flag is set, a non\-zero error code is returned\&. If the hostname is not found and the flag is not set, the address is returned in numeric form\&. .RE .PP \fBNI_NUMERICSERV\fR .RS 4 -The service name is returned as a digit string representing the port number. +The service name is returned as a digit string representing the port number\&. .RE .PP \fBNI_DGRAM\fR .RS 4 -Specifies that the service being looked up is a datagram service, and causes getservbyport() to be called with a second argument of "udp" instead of its default of "tcp". This is required for the few ports (512\-514) that have different services for UDP and TCP. +Specifies that the service being looked up is a datagram service, and causes getservbyport() to be called with a second argument of "udp" instead of its default of "tcp"\&. This is required for the few ports (512\-514) that have different services for UDP and TCP\&. .RE .SH "RETURN VALUES" .PP \fBlwres_getnameinfo()\fR -returns 0 on success or a non\-zero error code if an error occurs. +returns 0 on success or a non\-zero error code if an error occurs\&. .SH "SEE ALSO" .PP \fBRFC2133\fR(), \fBgetservbyport\fR(3), \fBlwres\fR(3), \fBlwres_getnameinfo\fR(3), -\fBlwres_getnamebyaddr\fR(3). -\fBlwres_net_ntop\fR(3). +\fBlwres_getnamebyaddr\fR(3)\&. +\fBlwres_net_ntop\fR(3)\&. .SH "BUGS" .PP RFC2133 fails to define what the nonzero return values of \fBgetnameinfo\fR(3) -are. +are\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.docbook b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.docbook index 34a72cb88..371b6f882 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.docbook @@ -1,8 +1,5 @@ -]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +37,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -69,8 +71,8 @@ int - - DESCRIPTION + DESCRIPTION + This function is equivalent to the @@ -158,16 +160,16 @@ int - + + + RETURN VALUES - - RETURN VALUES lwres_getnameinfo() returns 0 on success or a non-zero error code if an error occurs. - - - SEE ALSO + + SEE ALSO + RFC2133 , @@ -187,9 +189,9 @@ int lwres_net_ntop3 . - - - BUGS + + BUGS + RFC2133 fails to define what the nonzero return values of @@ -197,9 +199,5 @@ int are. - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.html b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.html index 6153e3b37..3b3d10f3a 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.html +++ b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.html @@ -1,5 +1,5 @@ - lwres_getnameinfo - + -

-
+
+

Name

lwres_getnameinfo — lightweight resolver socket address structure to hostname and @@ -33,56 +32,43 @@

Synopsis

#include <lwres/netdb.h>
- +
- - + - - + - - + - - + - - + - - + - - +
int lwres_getnameinfo(const struct sockaddr *  -sa, const struct sockaddr *sa,
 size_t   -salen, size_t salen,
 char *  -host, char *host,
 size_t   -hostlen, size_t hostlen,
 char *  -serv, char *serv,
 size_t   -servlen, size_t servlen,
 int   -flags);int flags);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

This function is equivalent to the getnameinfo(3) function defined in RFC2133. @@ -109,7 +95,7 @@ int following bits:

-
+
NI_NOFQDN

A fully qualified domain name is not required for local hosts. @@ -148,14 +134,14 @@ int

-
-

RETURN VALUES

+
+

RETURN VALUES

lwres_getnameinfo() returns 0 on success or a non-zero error code if an error occurs.

-
-

SEE ALSO

+
+

SEE ALSO

RFC2133, getservbyport(3), lwres(3), @@ -164,8 +150,8 @@ int lwres_net_ntop(3).

-
-

BUGS

+
+

BUGS

RFC2133 fails to define what the nonzero return values of getnameinfo(3) diff --git a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.3 b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.3 index 6397a6e0f..ac724c024 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.3 +++ b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,49 +13,63 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_getrrsetbyname .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_GETRRSETBYNAME" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_GETRRSETBYNAME" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_getrrsetbyname, lwres_freerrset \- retrieve DNS records .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 25 +.ft +.HP \w'int\ lwres_getrrsetbyname('u .BI "int lwres_getrrsetbyname(const\ char\ *" "hostname" ", unsigned\ int\ " "rdclass" ", unsigned\ int\ " "rdtype" ", unsigned\ int\ " "flags" ", struct\ rrsetinfo\ **" "res" ");" -.HP 21 +.HP \w'void\ lwres_freerrset('u .BI "void lwres_freerrset(struct\ rrsetinfo\ *" "rrset" ");" .PP The following structures are used: .PP -.RS 4 .nf struct rdatainfo { unsigned int rdi_length; /* length of data */ unsigned char *rdi_data; /* record data */ }; .fi -.RE -.sp .PP -.RS 4 .nf struct rrsetinfo { - unsigned int rri_flags; /* RRSET_VALIDATED... */ + unsigned int rri_flags; /* RRSET_VALIDATED\&.\&.\&. */ unsigned int rri_rdclass; /* class number */ unsigned int rri_rdtype; /* RR type number */ unsigned int rri_ttl; /* time to live */ @@ -66,7 +80,6 @@ struct rrsetinfo { struct rdatainfo *rri_sigs; /* individual signatures */ }; .fi -.RE .sp .SH "DESCRIPTION" .PP @@ -74,11 +87,11 @@ struct rrsetinfo { gets a set of resource records associated with a \fIhostname\fR, \fIclass\fR, and -\fItype\fR. +\fItype\fR\&. \fIhostname\fR -is a pointer a to null\-terminated string. The +is a pointer a to null\-terminated string\&. The \fIflags\fR -field is currently unused and must be zero. +field is currently unused and must be zero\&. .PP After a successful call to \fBlwres_getrrsetbyname()\fR, @@ -89,21 +102,21 @@ structure, containing a list of one or more \fBrdatainfo\fR structures containing resource records and potentially another list of \fBrdatainfo\fR -structures containing SIG resource records associated with those records. The members +structures containing SIG resource records associated with those records\&. The members \fBrri_rdclass\fR and \fBrri_rdtype\fR -are copied from the parameters. +are copied from the parameters\&. \fBrri_ttl\fR and \fBrri_name\fR -are properties of the obtained rrset. The resource records contained in +are properties of the obtained rrset\&. The resource records contained in \fBrri_rdatas\fR and \fBrri_sigs\fR -are in uncompressed DNS wire format. Properties of the rdataset are represented in the +are in uncompressed DNS wire format\&. Properties of the rdataset are represented in the \fBrri_flags\fR -bitfield. If the RRSET_VALIDATED bit is set, the data has been DNSSEC validated and the signatures verified. +bitfield\&. If the RRSET_VALIDATED bit is set, the data has been DNSSEC validated and the signatures verified\&. .PP All of the information returned by \fBlwres_getrrsetbyname()\fR @@ -112,15 +125,15 @@ is dynamically allocated: the and \fBrdatainfo\fR structures, and the canonical host name strings pointed to by the -\fBrrsetinfo\fRstructure. Memory allocated for the dynamically allocated structures created by a successful call to +\fBrrsetinfo\fRstructure\&. Memory allocated for the dynamically allocated structures created by a successful call to \fBlwres_getrrsetbyname()\fR is released by -\fBlwres_freerrset()\fR. +\fBlwres_freerrset()\fR\&. \fIrrset\fR is a pointer to a \fBstruct rrset\fR created by a call to -\fBlwres_getrrsetbyname()\fR. +\fBlwres_getrrsetbyname()\fR\&. .PP .SH "RETURN VALUES" .PP @@ -156,9 +169,13 @@ other failure .RE .SH "SEE ALSO" .PP -\fBlwres\fR(3). +\fBlwres\fR(3)\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.docbook b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.docbook index aceb5a1f9..c8de98e91 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.docbook @@ -1,8 +1,5 @@ -]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +37,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -97,8 +99,8 @@ struct rrsetinfo { - - DESCRIPTION + DESCRIPTION + lwres_getrrsetbyname() gets a set of resource records associated with a hostname, class, @@ -143,10 +145,10 @@ struct rrsetinfo { rrset created by a call to lwres_getrrsetbyname(). - - - - RETURN VALUES + + + RETURN VALUES + lwres_getrrsetbyname() returns zero on success, and one of the following error codes if an error occurred: @@ -200,24 +202,20 @@ struct rrsetinfo { - + - - - SEE ALSO + + SEE ALSO + lwres3 . - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.html b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.html index ad56c485b..33c718547 100644 --- a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.html +++ b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.html @@ -1,5 +1,5 @@ - lwres_getrrsetbyname - + -

-
+
+

Name

lwres_getrrsetbyname, lwres_freerrset — retrieve DNS records

@@ -31,48 +30,38 @@

Synopsis

#include <lwres/netdb.h>
- +
- - + - - + - - + - - + - - +
int lwres_getrrsetbyname(const char *  -hostname, const char *hostname,
 unsigned int   -rdclass, unsigned int rdclass,
 unsigned int   -rdtype, unsigned int rdtype,
 unsigned int   -flags, unsigned int flags,
 struct rrsetinfo **  -res);struct rrsetinfo **res);
- +
 
+
- - +
void lwres_freerrset(struct rrsetinfo *  -rrset);struct rrsetinfo *rrset);
+
 

The following structures are used: @@ -101,8 +90,8 @@ struct rrsetinfo {

-
-

DESCRIPTION

+
+

DESCRIPTION

lwres_getrrsetbyname() gets a set of resource records associated with a hostname, class, @@ -149,13 +138,13 @@ struct rrsetinfo {

-
-

RETURN VALUES

+
+

RETURN VALUES

lwres_getrrsetbyname() returns zero on success, and one of the following error codes if an error occurred:

-
+
ERRSET_NONAME

the name does not exist @@ -183,8 +172,8 @@ struct rrsetinfo {

-
-

SEE ALSO

+
+

SEE ALSO

lwres(3).

diff --git a/contrib/bind9/lib/lwres/man/lwres_gnba.3 b/contrib/bind9/lib/lwres/man/lwres_gnba.3 index 5c64f0714..4f6526855 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gnba.3 +++ b/contrib/bind9/lib/lwres/man/lwres_gnba.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,71 +13,97 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_gnba .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_GNBA" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_GNBA" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_gnbarequest_render, lwres_gnbaresponse_render, lwres_gnbarequest_parse, lwres_gnbaresponse_parse, lwres_gnbaresponse_free, lwres_gnbarequest_free \- lightweight resolver getnamebyaddress message handling .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 40 +.ft +.HP \w'lwres_result_t\ lwres_gnbarequest_render('u .BI "lwres_result_t lwres_gnbarequest_render(lwres_context_t\ *" "ctx" ", lwres_gnbarequest_t\ *" "req" ", lwres_lwpacket_t\ *" "pkt" ", lwres_buffer_t\ *" "b" ");" -.HP 41 +.HP \w'lwres_result_t\ lwres_gnbaresponse_render('u .BI "lwres_result_t lwres_gnbaresponse_render(lwres_context_t\ *" "ctx" ", lwres_gnbaresponse_t\ *" "req" ", lwres_lwpacket_t\ *" "pkt" ", lwres_buffer_t\ *" "b" ");" -.HP 39 +.HP \w'lwres_result_t\ lwres_gnbarequest_parse('u .BI "lwres_result_t lwres_gnbarequest_parse(lwres_context_t\ *" "ctx" ", lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ", lwres_gnbarequest_t\ **" "structp" ");" -.HP 40 +.HP \w'lwres_result_t\ lwres_gnbaresponse_parse('u .BI "lwres_result_t lwres_gnbaresponse_parse(lwres_context_t\ *" "ctx" ", lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ", lwres_gnbaresponse_t\ **" "structp" ");" -.HP 29 +.HP \w'void\ lwres_gnbaresponse_free('u .BI "void lwres_gnbaresponse_free(lwres_context_t\ *" "ctx" ", lwres_gnbaresponse_t\ **" "structp" ");" -.HP 28 +.HP \w'void\ lwres_gnbarequest_free('u .BI "void lwres_gnbarequest_free(lwres_context_t\ *" "ctx" ", lwres_gnbarequest_t\ **" "structp" ");" .SH "DESCRIPTION" .PP -These are low\-level routines for creating and parsing lightweight resolver address\-to\-name lookup request and response messages. +These are low\-level routines for creating and parsing lightweight resolver address\-to\-name lookup request and response messages\&. .PP -There are four main functions for the getnamebyaddr opcode. One render function converts a getnamebyaddr request structure \(em +There are four main functions for the getnamebyaddr opcode\&. One render function converts a getnamebyaddr request structure \(em \fBlwres_gnbarequest_t\fR -\(em to the lightweight resolver's canonical format. It is complemented by a parse function that converts a packet in this canonical format to a getnamebyaddr request structure. Another render function converts the getnamebyaddr response structure \(em +\(em to the lightweight resolver\*(Aqs canonical format\&. It is complemented by a parse function that converts a packet in this canonical format to a getnamebyaddr request structure\&. Another render function converts the getnamebyaddr response structure \(em \fBlwres_gnbaresponse_t\fR -to the canonical format. This is complemented by a parse function which converts a packet in canonical format to a getnamebyaddr response structure. +to the canonical format\&. This is complemented by a parse function which converts a packet in canonical format to a getnamebyaddr response structure\&. .PP These structures are defined in -\fIlwres/lwres.h\fR. They are shown below. +lwres/lwres\&.h\&. They are shown below\&. .PP +.if n \{\ .RS 4 +.\} .nf #define LWRES_OPCODE_GETNAMEBYADDR 0x00010002U .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf typedef struct { lwres_uint32_t flags; lwres_addr_t addr; } lwres_gnbarequest_t; .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf typedef struct { lwres_uint32_t flags; @@ -90,24 +116,25 @@ typedef struct { size_t baselen; } lwres_gnbaresponse_t; .fi +.if n \{\ .RE -.sp +.\} .PP \fBlwres_gnbarequest_render()\fR uses resolver context \fIctx\fR to convert getnamebyaddr request structure \fIreq\fR -to canonical format. The packet header structure +to canonical format\&. The packet header structure \fIpkt\fR is initialised and transferred to buffer -\fIb\fR. The contents of +\fIb\fR\&. The contents of \fI*req\fR -are then appended to the buffer in canonical format. +are then appended to the buffer in canonical format\&. \fBlwres_gnbaresponse_render()\fR performs the same task, except it converts a getnamebyaddr response structure \fBlwres_gnbaresponse_t\fR -to the lightweight resolver's canonical format. +to the lightweight resolver\*(Aqs canonical format\&. .PP \fBlwres_gnbarequest_parse()\fR uses context @@ -116,18 +143,18 @@ to convert the contents of packet \fIpkt\fR to a \fBlwres_gnbarequest_t\fR -structure. Buffer +structure\&. Buffer \fIb\fR -provides space to be used for storing this structure. When the function succeeds, the resulting +provides space to be used for storing this structure\&. When the function succeeds, the resulting \fBlwres_gnbarequest_t\fR is made available through -\fI*structp\fR. +\fI*structp\fR\&. \fBlwres_gnbaresponse_parse()\fR offers the same semantics as \fBlwres_gnbarequest_parse()\fR except it yields a \fBlwres_gnbaresponse_t\fR -structure. +structure\&. .PP \fBlwres_gnbaresponse_free()\fR and @@ -139,20 +166,19 @@ that was allocated to the or \fBlwres_gnbarequest_t\fR structures referenced via -\fIstructp\fR. Any memory associated with ancillary buffers and strings for those structures is also discarded. +\fIstructp\fR\&. Any memory associated with ancillary buffers and strings for those structures is also discarded\&. .SH "RETURN VALUES" .PP The getnamebyaddr opcode functions \fBlwres_gnbarequest_render()\fR, -\fBlwres_gnbaresponse_render()\fR -\fBlwres_gnbarequest_parse()\fR +\fBlwres_gnbaresponse_render()\fR\fBlwres_gnbarequest_parse()\fR and \fBlwres_gnbaresponse_parse()\fR all return \fBLWRES_R_SUCCESS\fR -on success. They return +on success\&. They return \fBLWRES_R_NOMEMORY\fR -if memory allocation fails. +if memory allocation fails\&. \fBLWRES_R_UNEXPECTEDEND\fR is returned if the available space in the buffer \fIb\fR @@ -160,24 +186,28 @@ is too small to accommodate the packet header or the \fBlwres_gnbarequest_t\fR and \fBlwres_gnbaresponse_t\fR -structures. +structures\&. \fBlwres_gnbarequest_parse()\fR and \fBlwres_gnbaresponse_parse()\fR will return \fBLWRES_R_UNEXPECTEDEND\fR -if the buffer is not empty after decoding the received packet. These functions will return +if the buffer is not empty after decoding the received packet\&. These functions will return \fBLWRES_R_FAILURE\fR if -pktflags +\fIpktflags\fR in the packet header structure \fBlwres_lwpacket_t\fR -indicate that the packet is not a response to an earlier query. +indicate that the packet is not a response to an earlier query\&. .SH "SEE ALSO" .PP -\fBlwres_packet\fR(3). +\fBlwres_packet\fR(3)\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_gnba.docbook b/contrib/bind9/lib/lwres/man/lwres_gnba.docbook index ebb7487b0..da6d3a8e5 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gnba.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_gnba.docbook @@ -1,8 +1,7 @@ -]> +]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +39,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -121,8 +125,8 @@ void - - DESCRIPTION + DESCRIPTION + These are low-level routines for creating and parsing lightweight resolver address-to-name lookup request and @@ -207,10 +211,10 @@ typedef struct { ancillary buffers and strings for those structures is also discarded. - + + + RETURN VALUES - - RETURN VALUES The getnamebyaddr opcode functions lwres_gnbarequest_render(), @@ -241,21 +245,17 @@ typedef struct { These functions will return LWRES_R_FAILURE if - pktflags + pktflags in the packet header structure lwres_lwpacket_t indicate that the packet is not a response to an earlier query. - - - SEE ALSO + + SEE ALSO + lwres_packet3 . - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_gnba.html b/contrib/bind9/lib/lwres/man/lwres_gnba.html index f05c05b36..4b8e7d910 100644 --- a/contrib/bind9/lib/lwres/man/lwres_gnba.html +++ b/contrib/bind9/lib/lwres/man/lwres_gnba.html @@ -1,5 +1,5 @@ - lwres_gnba - + -
-
+
+

Name

lwres_gnbarequest_render, lwres_gnbaresponse_render, lwres_gnbarequest_parse, lwres_gnbaresponse_parse, lwres_gnbaresponse_free, lwres_gnbarequest_free — lightweight resolver getnamebyaddress message handling

@@ -33,157 +32,123 @@ 
 #include <lwres/lwres.h>
- +
- - + - - + - - + - - +
lwres_result_t lwres_gnbarequest_render (lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_gnbarequest_t *  -req, lwres_gnbarequest_t *req,
 lwres_lwpacket_t *  -pkt, lwres_lwpacket_t *pkt,
 lwres_buffer_t *  -b);lwres_buffer_t *b);
- +
 
+
- - + - - + - - + - - +
lwres_result_t lwres_gnbaresponse_render (lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_gnbaresponse_t *  -req, lwres_gnbaresponse_t *req,
 lwres_lwpacket_t *  -pkt, lwres_lwpacket_t *pkt,
 lwres_buffer_t *  -b);lwres_buffer_t *b);
- +
 
+
- - + - - + - - + - - +
lwres_result_t lwres_gnbarequest_parse(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_buffer_t *  -b, lwres_buffer_t *b,
 lwres_lwpacket_t *  -pkt, lwres_lwpacket_t *pkt,
 lwres_gnbarequest_t **  -structp);lwres_gnbarequest_t **structp);
- +
 
+
- - + - - + - - + - - +
lwres_result_t lwres_gnbaresponse_parse(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_buffer_t *  -b, lwres_buffer_t *b,
 lwres_lwpacket_t *  -pkt, lwres_lwpacket_t *pkt,
 lwres_gnbaresponse_t **  -structp);lwres_gnbaresponse_t **structp);
- +
 
+
- - + - - +
void lwres_gnbaresponse_free (lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_gnbaresponse_t **  -structp);lwres_gnbaresponse_t **structp);
- +
 
+
- - + - - +
void lwres_gnbarequest_free(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_gnbarequest_t **  -structp);lwres_gnbarequest_t **structp);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

These are low-level routines for creating and parsing lightweight resolver address-to-name lookup request and @@ -269,8 +234,8 @@ typedef struct { discarded.

-
-

RETURN VALUES

+
+

RETURN VALUES

The getnamebyaddr opcode functions lwres_gnbarequest_render(), @@ -301,14 +266,14 @@ typedef struct { These functions will return LWRES_R_FAILURE if - pktflags + pktflags in the packet header structure lwres_lwpacket_t indicate that the packet is not a response to an earlier query.

-
-

SEE ALSO

+
+

SEE ALSO

lwres_packet(3).

diff --git a/contrib/bind9/lib/lwres/man/lwres_hstrerror.3 b/contrib/bind9/lib/lwres/man/lwres_hstrerror.3 index a8fa9788b..ec71b3e0c 100644 --- a/contrib/bind9/lib/lwres/man/lwres_hstrerror.3 +++ b/contrib/bind9/lib/lwres/man/lwres_hstrerror.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,31 +13,49 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_hstrerror .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_HSTRERROR" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_HSTRERROR" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_herror, lwres_hstrerror \- lightweight resolver error message generation .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 18 +.ft +.HP \w'void\ lwres_herror('u .BI "void lwres_herror(const\ char\ *" "s" ");" -.HP 29 +.HP \w'const\ char\ *\ lwres_hstrerror('u .BI "const char * lwres_hstrerror(int\ " "err" ");" .SH "DESCRIPTION" .PP @@ -49,11 +67,11 @@ on followed by the string generated by \fBlwres_hstrerror()\fR for the error code stored in the global variable -\fBlwres_h_errno\fR. +\fBlwres_h_errno\fR\&. .PP \fBlwres_hstrerror()\fR returns an appropriate string for the error code gievn by -\fIerr\fR. The values of the error codes and messages are as follows: +\fIerr\fR\&. The values of the error codes and messages are as follows: .PP \fBNETDB_SUCCESS\fR .RS 4 @@ -87,13 +105,17 @@ is returned by \fBlwres_hstrerror()\fR when the value of \fBlwres_h_errno\fR -is not a valid error code. +is not a valid error code\&. .SH "SEE ALSO" .PP \fBherror\fR(3), -\fBlwres_hstrerror\fR(3). +\fBlwres_hstrerror\fR(3)\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_hstrerror.docbook b/contrib/bind9/lib/lwres/man/lwres_hstrerror.docbook index d091b347d..59a2f268c 100644 --- a/contrib/bind9/lib/lwres/man/lwres_hstrerror.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_hstrerror.docbook @@ -1,8 +1,5 @@ -]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +37,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -68,8 +70,8 @@ const char * - - DESCRIPTION + DESCRIPTION + lwres_herror() prints the string s on @@ -121,10 +123,10 @@ const char * - + + + RETURN VALUES - - RETURN VALUES The string Unknown resolver error is returned by lwres_hstrerror() @@ -132,9 +134,9 @@ const char * lwres_h_errno is not a valid error code. - - - SEE ALSO + + SEE ALSO + herror3 , @@ -144,9 +146,5 @@ const char * . - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_hstrerror.html b/contrib/bind9/lib/lwres/man/lwres_hstrerror.html index 654e73f12..0f4dbe831 100644 --- a/contrib/bind9/lib/lwres/man/lwres_hstrerror.html +++ b/contrib/bind9/lib/lwres/man/lwres_hstrerror.html @@ -1,5 +1,5 @@ - lwres_hstrerror - + -
-
+
+

Name

lwres_herror, lwres_hstrerror — lightweight resolver error message generation

@@ -31,26 +30,24 @@

Synopsis

#include <lwres/netdb.h>
- +
- - +
void lwres_herror(const char *  -s);const char *s);
- +
 
+
- - +
const char * lwres_hstrerror(int   -err);int err);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

lwres_herror() prints the string s on stderr followed by the string generated by @@ -63,7 +60,7 @@ const char * messages are as follows:

-
+
NETDB_SUCCESS

Resolver Error 0 (no error)

@@ -83,8 +80,8 @@ const char *

-
-

RETURN VALUES

+
+

RETURN VALUES

The string Unknown resolver error is returned by lwres_hstrerror() @@ -93,8 +90,8 @@ const char * is not a valid error code.

-
-

SEE ALSO

+
+

SEE ALSO

herror(3), lwres_hstrerror(3). diff --git a/contrib/bind9/lib/lwres/man/lwres_inetntop.3 b/contrib/bind9/lib/lwres/man/lwres_inetntop.3 index c27b25e3d..077bbf609 100644 --- a/contrib/bind9/lib/lwres/man/lwres_inetntop.3 +++ b/contrib/bind9/lib/lwres/man/lwres_inetntop.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,29 +13,47 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_inetntop .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_INETNTOP" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_INETNTOP" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_net_ntop \- lightweight resolver IP address presentation .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 28 +.ft +.HP \w'const\ char\ *\ lwres_net_ntop('u .BI "const char * lwres_net_ntop(int\ " "af" ", const\ void\ *" "src" ", char\ *" "dst" ", size_t\ " "size" ");" .SH "DESCRIPTION" .PP @@ -44,17 +62,17 @@ converts an IP address of protocol family \fIaf\fR \(em IPv4 or IPv6 \(em at location \fIsrc\fR -from network format to its conventional representation as a string. For IPv4 addresses, that string would be a dotted\-decimal. An IPv6 address would be represented in colon notation as described in RFC1884. +from network format to its conventional representation as a string\&. For IPv4 addresses, that string would be a dotted\-decimal\&. An IPv6 address would be represented in colon notation as described in RFC1884\&. .PP The generated string is copied to \fIdst\fR provided \fIsize\fR -indicates it is long enough to store the ASCII representation of the address. +indicates it is long enough to store the ASCII representation of the address\&. .SH "RETURN VALUES" .PP If successful, the function returns -\fIdst\fR: a pointer to a string containing the presentation format of the address. +\fIdst\fR: a pointer to a string containing the presentation format of the address\&. \fBlwres_net_ntop()\fR returns \fBNULL\fR @@ -64,14 +82,18 @@ to \fBEAFNOSUPPORT\fR if the protocol family given in \fIaf\fR -is not supported. +is not supported\&. .SH "SEE ALSO" .PP \fBRFC1884\fR(), \fBinet_ntop\fR(3), -\fBerrno\fR(3). +\fBerrno\fR(3)\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_inetntop.docbook b/contrib/bind9/lib/lwres/man/lwres_inetntop.docbook index b2d170f29..cf32a54b4 100644 --- a/contrib/bind9/lib/lwres/man/lwres_inetntop.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_inetntop.docbook @@ -1,8 +1,7 @@ -]> +]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +39,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -64,8 +68,8 @@ const char * - - DESCRIPTION + DESCRIPTION + lwres_net_ntop() converts an IP address of protocol family @@ -84,9 +88,9 @@ const char * ASCII representation of the address. - - - RETURN VALUES + + RETURN VALUES + If successful, the function returns dst: @@ -99,9 +103,9 @@ const char * supported. - - - SEE ALSO + + SEE ALSO + RFC1884 , @@ -112,9 +116,5 @@ const char * errno3 . - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_inetntop.html b/contrib/bind9/lib/lwres/man/lwres_inetntop.html index 99cad662b..1e08e7a76 100644 --- a/contrib/bind9/lib/lwres/man/lwres_inetntop.html +++ b/contrib/bind9/lib/lwres/man/lwres_inetntop.html @@ -1,5 +1,5 @@ - lwres_inetntop - + -

-
+
+

Name

lwres_net_ntop — lightweight resolver IP address presentation

@@ -31,38 +30,31 @@

Synopsis

#include <lwres/net.h>
- +
- - + - - + - - + - - +
const char * lwres_net_ntop(int   -af, int af,
 const void *  -src, const void *src,
 char *  -dst, char *dst,
 size_t   -size);size_t size);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

lwres_net_ntop() converts an IP address of protocol family af — IPv4 or IPv6 — at @@ -79,8 +71,8 @@ const char * ASCII representation of the address.

-
-

RETURN VALUES

+
+

RETURN VALUES

If successful, the function returns dst: a pointer to a string containing the presentation format of the @@ -92,8 +84,8 @@ const char * supported.

-
-

SEE ALSO

+
+

SEE ALSO

RFC1884, inet_ntop(3), errno(3). diff --git a/contrib/bind9/lib/lwres/man/lwres_noop.3 b/contrib/bind9/lib/lwres/man/lwres_noop.3 index cacbd4b6a..423cdd301 100644 --- a/contrib/bind9/lib/lwres/man/lwres_noop.3 +++ b/contrib/bind9/lib/lwres/man/lwres_noop.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,101 +13,128 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_noop .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_NOOP" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_NOOP" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_nooprequest_render, lwres_noopresponse_render, lwres_nooprequest_parse, lwres_noopresponse_parse, lwres_noopresponse_free, lwres_nooprequest_free \- lightweight resolver no\-op message handling .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 40 +.ft +.HP \w'lwres_result_t\ lwres_nooprequest_render('u .BI "lwres_result_t lwres_nooprequest_render(lwres_context_t\ *" "ctx" ", lwres_nooprequest_t\ *" "req" ", lwres_lwpacket_t\ *" "pkt" ", lwres_buffer_t\ *" "b" ");" -.HP 41 +.HP \w'lwres_result_t\ lwres_noopresponse_render('u .BI "lwres_result_t lwres_noopresponse_render(lwres_context_t\ *" "ctx" ", lwres_noopresponse_t\ *" "req" ", lwres_lwpacket_t\ *" "pkt" ", lwres_buffer_t\ *" "b" ");" -.HP 39 +.HP \w'lwres_result_t\ lwres_nooprequest_parse('u .BI "lwres_result_t lwres_nooprequest_parse(lwres_context_t\ *" "ctx" ", lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ", lwres_nooprequest_t\ **" "structp" ");" -.HP 40 +.HP \w'lwres_result_t\ lwres_noopresponse_parse('u .BI "lwres_result_t lwres_noopresponse_parse(lwres_context_t\ *" "ctx" ", lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ", lwres_noopresponse_t\ **" "structp" ");" -.HP 29 +.HP \w'void\ lwres_noopresponse_free('u .BI "void lwres_noopresponse_free(lwres_context_t\ *" "ctx" ", lwres_noopresponse_t\ **" "structp" ");" -.HP 28 +.HP \w'void\ lwres_nooprequest_free('u .BI "void lwres_nooprequest_free(lwres_context_t\ *" "ctx" ", lwres_nooprequest_t\ **" "structp" ");" .SH "DESCRIPTION" .PP -These are low\-level routines for creating and parsing lightweight resolver no\-op request and response messages. +These are low\-level routines for creating and parsing lightweight resolver no\-op request and response messages\&. .PP The no\-op message is analogous to a \fBping\fR -packet: a packet is sent to the resolver daemon and is simply echoed back. The opcode is intended to allow a client to determine if the server is operational or not. +packet: a packet is sent to the resolver daemon and is simply echoed back\&. The opcode is intended to allow a client to determine if the server is operational or not\&. .PP -There are four main functions for the no\-op opcode. One render function converts a no\-op request structure \(em +There are four main functions for the no\-op opcode\&. One render function converts a no\-op request structure \(em \fBlwres_nooprequest_t\fR -\(em to the lightweight resolver's canonical format. It is complemented by a parse function that converts a packet in this canonical format to a no\-op request structure. Another render function converts the no\-op response structure \(em +\(em to the lightweight resolver\*(Aqs canonical format\&. It is complemented by a parse function that converts a packet in this canonical format to a no\-op request structure\&. Another render function converts the no\-op response structure \(em \fBlwres_noopresponse_t\fR -to the canonical format. This is complemented by a parse function which converts a packet in canonical format to a no\-op response structure. +to the canonical format\&. This is complemented by a parse function which converts a packet in canonical format to a no\-op response structure\&. .PP These structures are defined in -\fIlwres/lwres.h\fR. They are shown below. +lwres/lwres\&.h\&. They are shown below\&. .PP +.if n \{\ .RS 4 +.\} .nf #define LWRES_OPCODE_NOOP 0x00000000U .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf typedef struct { lwres_uint16_t datalength; unsigned char *data; } lwres_nooprequest_t; .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf typedef struct { lwres_uint16_t datalength; unsigned char *data; } lwres_noopresponse_t; .fi +.if n \{\ .RE -.sp +.\} .PP -Although the structures have different types, they are identical. This is because the no\-op opcode simply echos whatever data was sent: the response is therefore identical to the request. +Although the structures have different types, they are identical\&. This is because the no\-op opcode simply echos whatever data was sent: the response is therefore identical to the request\&. .PP \fBlwres_nooprequest_render()\fR uses resolver context \fIctx\fR to convert no\-op request structure \fIreq\fR -to canonical format. The packet header structure +to canonical format\&. The packet header structure \fIpkt\fR is initialised and transferred to buffer -\fIb\fR. The contents of +\fIb\fR\&. The contents of \fI*req\fR -are then appended to the buffer in canonical format. +are then appended to the buffer in canonical format\&. \fBlwres_noopresponse_render()\fR performs the same task, except it converts a no\-op response structure \fBlwres_noopresponse_t\fR -to the lightweight resolver's canonical format. +to the lightweight resolver\*(Aqs canonical format\&. .PP \fBlwres_nooprequest_parse()\fR uses context @@ -116,18 +143,18 @@ to convert the contents of packet \fIpkt\fR to a \fBlwres_nooprequest_t\fR -structure. Buffer +structure\&. Buffer \fIb\fR -provides space to be used for storing this structure. When the function succeeds, the resulting +provides space to be used for storing this structure\&. When the function succeeds, the resulting \fBlwres_nooprequest_t\fR is made available through -\fI*structp\fR. +\fI*structp\fR\&. \fBlwres_noopresponse_parse()\fR offers the same semantics as \fBlwres_nooprequest_parse()\fR except it yields a \fBlwres_noopresponse_t\fR -structure. +structure\&. .PP \fBlwres_noopresponse_free()\fR and @@ -139,20 +166,19 @@ that was allocated to the or \fBlwres_nooprequest_t\fR structures referenced via -\fIstructp\fR. +\fIstructp\fR\&. .SH "RETURN VALUES" .PP The no\-op opcode functions \fBlwres_nooprequest_render()\fR, -\fBlwres_noopresponse_render()\fR -\fBlwres_nooprequest_parse()\fR +\fBlwres_noopresponse_render()\fR\fBlwres_nooprequest_parse()\fR and \fBlwres_noopresponse_parse()\fR all return \fBLWRES_R_SUCCESS\fR -on success. They return +on success\&. They return \fBLWRES_R_NOMEMORY\fR -if memory allocation fails. +if memory allocation fails\&. \fBLWRES_R_UNEXPECTEDEND\fR is returned if the available space in the buffer \fIb\fR @@ -160,24 +186,28 @@ is too small to accommodate the packet header or the \fBlwres_nooprequest_t\fR and \fBlwres_noopresponse_t\fR -structures. +structures\&. \fBlwres_nooprequest_parse()\fR and \fBlwres_noopresponse_parse()\fR will return \fBLWRES_R_UNEXPECTEDEND\fR -if the buffer is not empty after decoding the received packet. These functions will return +if the buffer is not empty after decoding the received packet\&. These functions will return \fBLWRES_R_FAILURE\fR if \fBpktflags\fR in the packet header structure \fBlwres_lwpacket_t\fR -indicate that the packet is not a response to an earlier query. +indicate that the packet is not a response to an earlier query\&. .SH "SEE ALSO" .PP \fBlwres_packet\fR(3) +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_noop.docbook b/contrib/bind9/lib/lwres/man/lwres_noop.docbook index 8f40990b4..b482c1a36 100644 --- a/contrib/bind9/lib/lwres/man/lwres_noop.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_noop.docbook @@ -1,8 +1,7 @@ -]> +]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +39,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -110,8 +114,8 @@ void - - DESCRIPTION + DESCRIPTION + These are low-level routines for creating and parsing lightweight resolver no-op request and response messages. @@ -201,9 +205,9 @@ typedef struct { structp. - - - RETURN VALUES + + RETURN VALUES + The no-op opcode functions lwres_nooprequest_render(), @@ -240,16 +244,12 @@ typedef struct { lwres_lwpacket_t indicate that the packet is not a response to an earlier query. - - - SEE ALSO + + SEE ALSO + lwres_packet3 - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_noop.html b/contrib/bind9/lib/lwres/man/lwres_noop.html index e1d499cff..6f67cab98 100644 --- a/contrib/bind9/lib/lwres/man/lwres_noop.html +++ b/contrib/bind9/lib/lwres/man/lwres_noop.html @@ -1,5 +1,5 @@ - lwres_noop - + -

-
+
+

Name

lwres_nooprequest_render, lwres_noopresponse_render, lwres_nooprequest_parse, lwres_noopresponse_parse, lwres_noopresponse_free, lwres_nooprequest_free — lightweight resolver no-op message handling

@@ -32,160 +31,126 @@ 
 #include <lwres/lwres.h>
- +
- - + - - + - - + - - +
lwres_result_t lwres_nooprequest_render(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_nooprequest_t *  -req, lwres_nooprequest_t *req,
 lwres_lwpacket_t *  -pkt, lwres_lwpacket_t *pkt,
 lwres_buffer_t *  -b);lwres_buffer_t *b);
- +
 
+
- - + - - + - - + - - +
lwres_result_t lwres_noopresponse_render(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_noopresponse_t *  -req, lwres_noopresponse_t *req,
 lwres_lwpacket_t *  -pkt, lwres_lwpacket_t *pkt,
 lwres_buffer_t *  -b);lwres_buffer_t *b);
- +
 
+
- - + - - + - - + - - +
lwres_result_t lwres_nooprequest_parse(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_buffer_t *  -b, lwres_buffer_t *b,
 lwres_lwpacket_t *  -pkt, lwres_lwpacket_t *pkt,
 lwres_nooprequest_t **  -structp);lwres_nooprequest_t **structp);
- +
 
+
- - + - - + - - + - - +
lwres_result_t lwres_noopresponse_parse(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_buffer_t *  -b, lwres_buffer_t *b,
 lwres_lwpacket_t *  -pkt, lwres_lwpacket_t *pkt,
 lwres_noopresponse_t **  -structp);lwres_noopresponse_t **structp);
- +
 
+
- - + - - +
void lwres_noopresponse_free(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_noopresponse_t **  -structp);lwres_noopresponse_t **structp);
- +
 
+
- - + - - +
void lwres_nooprequest_free(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_nooprequest_t **  -structp);lwres_nooprequest_t **structp);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

These are low-level routines for creating and parsing lightweight resolver no-op request and response messages.

- The no-op message is analogous to a ping + The no-op message is analogous to a ping packet: a packet is sent to the resolver daemon and is simply echoed back. The opcode is intended to allow a client to determine if the server is @@ -269,8 +234,8 @@ typedef struct { structp.

-
-

RETURN VALUES

+
+

RETURN VALUES

The no-op opcode functions lwres_nooprequest_render(), @@ -308,8 +273,8 @@ typedef struct { indicate that the packet is not a response to an earlier query.

-
-

SEE ALSO

+
+

SEE ALSO

lwres_packet(3)

diff --git a/contrib/bind9/lib/lwres/man/lwres_packet.3 b/contrib/bind9/lib/lwres/man/lwres_packet.3 index a33990fc3..8f5c02053 100644 --- a/contrib/bind9/lib/lwres/man/lwres_packet.3 +++ b/contrib/bind9/lib/lwres/man/lwres_packet.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,47 +13,70 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_packet .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_PACKET" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_PACKET" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_lwpacket_renderheader, lwres_lwpacket_parseheader \- lightweight resolver packet handling functions .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 43 +.ft +.HP \w'lwres_result_t\ lwres_lwpacket_renderheader('u .BI "lwres_result_t lwres_lwpacket_renderheader(lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ");" -.HP 42 +.HP \w'lwres_result_t\ lwres_lwpacket_parseheader('u .BI "lwres_result_t lwres_lwpacket_parseheader(lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ");" .SH "DESCRIPTION" .PP These functions rely on a \fBstruct lwres_lwpacket\fR which is defined in -\fIlwres/lwpacket.h\fR. +lwres/lwpacket\&.h\&. .PP +.if n \{\ .RS 4 +.\} .nf typedef struct lwres_lwpacket lwres_lwpacket_t; .fi +.if n \{\ .RE -.sp +.\} .PP +.if n \{\ .RS 4 +.\} .nf struct lwres_lwpacket { lwres_uint32_t length; @@ -67,89 +90,89 @@ struct lwres_lwpacket { lwres_uint16_t authlength; }; .fi +.if n \{\ .RE -.sp +.\} .PP The elements of this structure are: .PP \fBlength\fR .RS 4 -the overall packet length, including the entire packet header. This field is filled in by the lwres_gabn_*() and lwres_gnba_*() calls. +the overall packet length, including the entire packet header\&. This field is filled in by the lwres_gabn_*() and lwres_gnba_*() calls\&. .RE .PP \fBversion\fR .RS 4 -the header format. There is currently only one format, -\fBLWRES_LWPACKETVERSION_0\fR. This field is filled in by the lwres_gabn_*() and lwres_gnba_*() calls. +the header format\&. There is currently only one format, +\fBLWRES_LWPACKETVERSION_0\fR\&. This field is filled in by the lwres_gabn_*() and lwres_gnba_*() calls\&. .RE .PP \fBpktflags\fR .RS 4 -library\-defined flags for this packet: for instance whether the packet is a request or a reply. Flag values can be set, but not defined by the caller. This field is filled in by the application wit the exception of the LWRES_LWPACKETFLAG_RESPONSE bit, which is set by the library in the lwres_gabn_*() and lwres_gnba_*() calls. +library\-defined flags for this packet: for instance whether the packet is a request or a reply\&. Flag values can be set, but not defined by the caller\&. This field is filled in by the application wit the exception of the LWRES_LWPACKETFLAG_RESPONSE bit, which is set by the library in the lwres_gabn_*() and lwres_gnba_*() calls\&. .RE .PP \fBserial\fR .RS 4 -is set by the requestor and is returned in all replies. If two or more packets from the same source have the same serial number and are from the same source, they are assumed to be duplicates and the latter ones may be dropped. This field must be set by the application. +is set by the requestor and is returned in all replies\&. If two or more packets from the same source have the same serial number and are from the same source, they are assumed to be duplicates and the latter ones may be dropped\&. This field must be set by the application\&. .RE .PP \fBopcode\fR .RS 4 -indicates the operation. Opcodes between 0x00000000 and 0x03ffffff are reserved for use by the lightweight resolver library. Opcodes between 0x04000000 and 0xffffffff are application defined. This field is filled in by the lwres_gabn_*() and lwres_gnba_*() calls. +indicates the operation\&. Opcodes between 0x00000000 and 0x03ffffff are reserved for use by the lightweight resolver library\&. Opcodes between 0x04000000 and 0xffffffff are application defined\&. This field is filled in by the lwres_gabn_*() and lwres_gnba_*() calls\&. .RE .PP \fBresult\fR .RS 4 -is only valid for replies. Results between 0x04000000 and 0xffffffff are application defined. Results between 0x00000000 and 0x03ffffff are reserved for library use. This field is filled in by the lwres_gabn_*() and lwres_gnba_*() calls. +is only valid for replies\&. Results between 0x04000000 and 0xffffffff are application defined\&. Results between 0x00000000 and 0x03ffffff are reserved for library use\&. This field is filled in by the lwres_gabn_*() and lwres_gnba_*() calls\&. .RE .PP \fBrecvlength\fR .RS 4 -is the maximum buffer size that the receiver can handle on requests and the size of the buffer needed to satisfy a request when the buffer is too large for replies. This field is supplied by the application. +is the maximum buffer size that the receiver can handle on requests and the size of the buffer needed to satisfy a request when the buffer is too large for replies\&. This field is supplied by the application\&. .RE .PP \fBauthtype\fR .RS 4 -defines the packet level authentication that is used. Authorisation types between 0x1000 and 0xffff are application defined and types between 0x0000 and 0x0fff are reserved for library use. Currently these are not used and must be zero. +defines the packet level authentication that is used\&. Authorisation types between 0x1000 and 0xffff are application defined and types between 0x0000 and 0x0fff are reserved for library use\&. Currently these are not used and must be zero\&. .RE .PP \fBauthlen\fR .RS 4 -gives the length of the authentication data. Since packet authentication is currently not used, this must be zero. +gives the length of the authentication data\&. Since packet authentication is currently not used, this must be zero\&. .RE .PP The following opcodes are currently defined: .PP \fBNOOP\fR .RS 4 -Success is always returned and the packet contents are echoed. The lwres_noop_*() functions should be used for this type. +Success is always returned and the packet contents are echoed\&. The lwres_noop_*() functions should be used for this type\&. .RE .PP \fBGETADDRSBYNAME\fR .RS 4 -returns all known addresses for a given name. The lwres_gabn_*() functions should be used for this type. +returns all known addresses for a given name\&. The lwres_gabn_*() functions should be used for this type\&. .RE .PP \fBGETNAMEBYADDR\fR .RS 4 -return the hostname for the given address. The lwres_gnba_*() functions should be used for this type. +return the hostname for the given address\&. The lwres_gnba_*() functions should be used for this type\&. .RE .PP \fBlwres_lwpacket_renderheader()\fR transfers the contents of lightweight resolver packet structure -\fBlwres_lwpacket_t\fR -\fI*pkt\fR +\fBlwres_lwpacket_t\fR\fI*pkt\fR in network byte order to the lightweight resolver buffer, -\fI*b\fR. +\fI*b\fR\&. .PP \fBlwres_lwpacket_parseheader()\fR -performs the converse operation. It transfers data in network byte order from buffer +performs the converse operation\&. It transfers data in network byte order from buffer \fI*b\fR to resolver packet -\fI*pkt\fR. The contents of the buffer +\fI*pkt\fR\&. The contents of the buffer \fIb\fR should correspond to a -\fBlwres_lwpacket_t\fR. +\fBlwres_lwpacket_t\fR\&. .SH "RETURN VALUES" .PP Successful calls to @@ -157,14 +180,18 @@ Successful calls to and \fBlwres_lwpacket_parseheader()\fR return -\fBLWRES_R_SUCCESS\fR. If there is insufficient space to copy data between the buffer +\fBLWRES_R_SUCCESS\fR\&. If there is insufficient space to copy data between the buffer \fI*b\fR and lightweight resolver packet \fI*pkt\fR both functions return -\fBLWRES_R_UNEXPECTEDEND\fR. +\fBLWRES_R_UNEXPECTEDEND\fR\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_packet.docbook b/contrib/bind9/lib/lwres/man/lwres_packet.docbook index b94626350..321248b2c 100644 --- a/contrib/bind9/lib/lwres/man/lwres_packet.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_packet.docbook @@ -1,8 +1,5 @@ -]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +37,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -69,8 +71,8 @@ lwres_result_t - - DESCRIPTION + DESCRIPTION + These functions rely on a struct lwres_lwpacket @@ -268,10 +270,10 @@ struct lwres_lwpacket { lwres_lwpacket_t. - + + + RETURN VALUES - - RETURN VALUES Successful calls to lwres_lwpacket_renderheader() and @@ -283,9 +285,5 @@ struct lwres_lwpacket { return LWRES_R_UNEXPECTEDEND. - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_packet.html b/contrib/bind9/lib/lwres/man/lwres_packet.html index d0542daa7..411644310 100644 --- a/contrib/bind9/lib/lwres/man/lwres_packet.html +++ b/contrib/bind9/lib/lwres/man/lwres_packet.html @@ -1,5 +1,5 @@ - lwres_packet - + -
-
+
+

Name

lwres_lwpacket_renderheader, lwres_lwpacket_parseheader — lightweight resolver packet handling functions

@@ -31,42 +30,36 @@

Synopsis

#include <lwres/lwpacket.h>
- +
- - + - - +
lwres_result_t lwres_lwpacket_renderheader(lwres_buffer_t *  -b, lwres_buffer_t *b,
 lwres_lwpacket_t *  -pkt);lwres_lwpacket_t *pkt);
- +
 
+
- - + - - +
lwres_result_t lwres_lwpacket_parseheader(lwres_buffer_t *  -b, lwres_buffer_t *b,
 lwres_lwpacket_t *  -pkt);lwres_lwpacket_t *pkt);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

These functions rely on a struct lwres_lwpacket @@ -96,7 +89,7 @@ struct lwres_lwpacket {

The elements of this structure are:

-
+
length

the overall packet length, including the entire packet header. @@ -185,7 +178,7 @@ struct lwres_lwpacket {

The following opcodes are currently defined:

-
+
NOOP

Success is always returned and the packet contents are echoed. @@ -218,8 +211,8 @@ struct lwres_lwpacket { lwres_lwpacket_t.

-
-

RETURN VALUES

+
+

RETURN VALUES

Successful calls to lwres_lwpacket_renderheader() and diff --git a/contrib/bind9/lib/lwres/man/lwres_resutil.3 b/contrib/bind9/lib/lwres/man/lwres_resutil.3 index 0125c788d..991fb05ca 100644 --- a/contrib/bind9/lib/lwres/man/lwres_resutil.3 +++ b/contrib/bind9/lib/lwres/man/lwres_resutil.3 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .\" Copyright (C) 2000, 2001 Internet Software Consortium. .\" .\" Permission to use, copy, modify, and/or distribute this software for any @@ -13,59 +13,77 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id$ -.\" .hy 0 .ad l +'\" t .\" Title: lwres_resutil .\" Author: -.\" Generator: DocBook XSL Stylesheets v1.71.1 -.\" Date: June 18, 2007 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 2007-06-18 .\" Manual: BIND9 -.\" Source: BIND9 +.\" Source: ISC +.\" Language: English .\" -.TH "LWRES_RESUTIL" "3" "June 18, 2007" "BIND9" "BIND9" +.TH "LWRES_RESUTIL" "3" "2007\-06\-18" "ISC" "BIND9" +.\" ----------------------------------------------------------------- +.\" * Define some portability stuff +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" http://bugs.debian.org/507673 +.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- .SH "NAME" lwres_string_parse, lwres_addr_parse, lwres_getaddrsbyname, lwres_getnamebyaddr \- lightweight resolver utility functions .SH "SYNOPSIS" +.sp +.ft B .nf -#include +#include .fi -.HP 34 +.ft +.HP \w'lwres_result_t\ lwres_string_parse('u .BI "lwres_result_t lwres_string_parse(lwres_buffer_t\ *" "b" ", char\ **" "c" ", lwres_uint16_t\ *" "len" ");" -.HP 32 +.HP \w'lwres_result_t\ lwres_addr_parse('u .BI "lwres_result_t lwres_addr_parse(lwres_buffer_t\ *" "b" ", lwres_addr_t\ *" "addr" ");" -.HP 36 +.HP \w'lwres_result_t\ lwres_getaddrsbyname('u .BI "lwres_result_t lwres_getaddrsbyname(lwres_context_t\ *" "ctx" ", const\ char\ *" "name" ", lwres_uint32_t\ " "addrtypes" ", lwres_gabnresponse_t\ **" "structp" ");" -.HP 35 +.HP \w'lwres_result_t\ lwres_getnamebyaddr('u .BI "lwres_result_t lwres_getnamebyaddr(lwres_context_t\ *" "ctx" ", lwres_uint32_t\ " "addrtype" ", lwres_uint16_t\ " "addrlen" ", const\ unsigned\ char\ *" "addr" ", lwres_gnbaresponse_t\ **" "structp" ");" .SH "DESCRIPTION" .PP \fBlwres_string_parse()\fR retrieves a DNS\-encoded string starting the current pointer of lightweight resolver buffer -\fIb\fR: i.e. -\fBb\->current\fR. When the function returns, the address of the first byte of the encoded string is returned via +\fIb\fR: i\&.e\&. +\fBb\->current\fR\&. When the function returns, the address of the first byte of the encoded string is returned via \fI*c\fR and the length of that string is given by -\fI*len\fR. The buffer's current pointer is advanced to point at the character following the string length, the encoded string, and the trailing +\fI*len\fR\&. The buffer\*(Aqs current pointer is advanced to point at the character following the string length, the encoded string, and the trailing \fBNULL\fR -character. +character\&. .PP \fBlwres_addr_parse()\fR extracts an address from the buffer -\fIb\fR. The buffer's current pointer +\fIb\fR\&. The buffer\*(Aqs current pointer \fBb\->current\fR -is presumed to point at an encoded address: the address preceded by a 32\-bit protocol family identifier and a 16\-bit length field. The encoded address is copied to +is presumed to point at an encoded address: the address preceded by a 32\-bit protocol family identifier and a 16\-bit length field\&. The encoded address is copied to \fBaddr\->address\fR and \fBaddr\->length\fR -indicates the size in bytes of the address that was copied. +indicates the size in bytes of the address that was copied\&. \fBb\->current\fR -is advanced to point at the next byte of available data in the buffer following the encoded address. +is advanced to point at the next byte of available data in the buffer following the encoded address\&. .PP \fBlwres_getaddrsbyname()\fR and @@ -74,7 +92,9 @@ use the \fBlwres_gnbaresponse_t\fR structure defined below: .PP +.if n \{\ .RS 4 +.\} .nf typedef struct { lwres_uint32_t flags; @@ -89,40 +109,42 @@ typedef struct { size_t baselen; } lwres_gabnresponse_t; .fi +.if n \{\ .RE +.\} .PP The contents of this structure are not manipulated directly but they are controlled through the \fBlwres_gabn\fR(3) -functions. +functions\&. .PP The lightweight resolver uses \fBlwres_getaddrsbyname()\fR -to perform forward lookups. Hostname +to perform forward lookups\&. Hostname \fIname\fR is looked up using the resolver context \fIctx\fR -for memory allocation. +for memory allocation\&. \fIaddrtypes\fR -is a bitmask indicating which type of addresses are to be looked up. Current values for this bitmask are +is a bitmask indicating which type of addresses are to be looked up\&. Current values for this bitmask are \fBLWRES_ADDRTYPE_V4\fR for IPv4 addresses and \fBLWRES_ADDRTYPE_V6\fR -for IPv6 addresses. Results of the lookup are returned in -\fI*structp\fR. +for IPv6 addresses\&. Results of the lookup are returned in +\fI*structp\fR\&. .PP \fBlwres_getnamebyaddr()\fR -performs reverse lookups. Resolver context +performs reverse lookups\&. Resolver context \fIctx\fR -is used for memory allocation. The address type is indicated by +is used for memory allocation\&. The address type is indicated by \fIaddrtype\fR: \fBLWRES_ADDRTYPE_V4\fR or -\fBLWRES_ADDRTYPE_V6\fR. The address to be looked up is given by +\fBLWRES_ADDRTYPE_V6\fR\&. The address to be looked up is given by \fIaddr\fR and its length is \fIaddrlen\fR -bytes. The result of the function call is made available through -\fI*structp\fR. +bytes\&. The result of the function call is made available through +\fI*structp\fR\&. .SH "RETURN VALUES" .PP Successful calls to @@ -130,12 +152,12 @@ Successful calls to and \fBlwres_addr_parse()\fR return -\fBLWRES_R_SUCCESS.\fR +\fBLWRES_R_SUCCESS\&.\fR Both functions return \fBLWRES_R_FAILURE\fR if the buffer is corrupt or \fBLWRES_R_UNEXPECTEDEND\fR -if the buffer has less space than expected for the components of the encoded string or address. +if the buffer has less space than expected for the components of the encoded string or address\&. .PP \fBlwres_getaddrsbyname()\fR returns @@ -144,11 +166,11 @@ on success and it returns \fBLWRES_R_NOTFOUND\fR if the hostname \fIname\fR -could not be found. +could not be found\&. .PP \fBLWRES_R_SUCCESS\fR is returned by a successful call to -\fBlwres_getnamebyaddr()\fR. +\fBlwres_getnamebyaddr()\fR\&. .PP Both \fBlwres_getaddrsbyname()\fR @@ -158,13 +180,17 @@ return \fBLWRES_R_NOMEMORY\fR when memory allocation requests fail and \fBLWRES_R_UNEXPECTEDEND\fR -if the buffers used for sending queries and receiving replies are too small. +if the buffers used for sending queries and receiving replies are too small\&. .SH "SEE ALSO" .PP \fBlwres_buffer\fR(3), -\fBlwres_gabn\fR(3). +\fBlwres_gabn\fR(3)\&. +.SH "AUTHOR" +.PP +\fBInternet Systems Consortium, Inc\&.\fR .SH "COPYRIGHT" -Copyright \(co 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") +.br +Copyright \(co 2004, 2005, 2007, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") .br Copyright \(co 2000, 2001 Internet Software Consortium. .br diff --git a/contrib/bind9/lib/lwres/man/lwres_resutil.docbook b/contrib/bind9/lib/lwres/man/lwres_resutil.docbook index 0a0c4704a..802483d07 100644 --- a/contrib/bind9/lib/lwres/man/lwres_resutil.docbook +++ b/contrib/bind9/lib/lwres/man/lwres_resutil.docbook @@ -1,8 +1,5 @@ -]> - - + + + + 2007-06-18 + - June 18, 2007 + ISC + Internet Systems Consortium, Inc. @@ -36,6 +37,7 @@ 2005 2007 2014 + 2015 Internet Systems Consortium, Inc. ("ISC") @@ -92,8 +94,8 @@ lwres_result_t - - DESCRIPTION + DESCRIPTION + lwres_string_parse() retrieves a DNS-encoded string starting the current pointer of @@ -176,10 +178,10 @@ typedef struct { function call is made available through *structp. - + + + RETURN VALUES - - RETURN VALUES Successful calls to lwres_string_parse() @@ -218,9 +220,9 @@ typedef struct { small. - - - SEE ALSO + + SEE ALSO + lwres_buffer3 , @@ -230,9 +232,5 @@ typedef struct { . - - + + diff --git a/contrib/bind9/lib/lwres/man/lwres_resutil.html b/contrib/bind9/lib/lwres/man/lwres_resutil.html index 28e571b4a..5855978c2 100644 --- a/contrib/bind9/lib/lwres/man/lwres_resutil.html +++ b/contrib/bind9/lib/lwres/man/lwres_resutil.html @@ -1,5 +1,5 @@ - lwres_resutil - + -

-
+
+

Name

lwres_string_parse, lwres_addr_parse, lwres_getaddrsbyname, lwres_getnamebyaddr — lightweight resolver utility functions

@@ -31,110 +30,86 @@

Synopsis

#include <lwres/lwres.h>
- +
- - + - - + - - +
lwres_result_t lwres_string_parse(lwres_buffer_t *  -b, lwres_buffer_t *b,
 char **  -c, char **c,
 lwres_uint16_t *  -len);lwres_uint16_t *len);
- +
 
+
- - + - - +
lwres_result_t lwres_addr_parse(lwres_buffer_t *  -b, lwres_buffer_t *b,
 lwres_addr_t *  -addr);lwres_addr_t *addr);
- +
 
+
- - + - - + - - + - - +
lwres_result_t lwres_getaddrsbyname(lwres_context_t *  -ctx, lwres_context_t *ctx,
 const char *  -name, const char *name,
 lwres_uint32_t   -addrtypes, lwres_uint32_t addrtypes,
 lwres_gabnresponse_t **  -structp);lwres_gabnresponse_t **structp);
- +
 
+
- - + - - + - - + - - + - - +
lwres_result_t lwres_getnamebyaddr(lwres_context_t *  -ctx, lwres_context_t *ctx,
 lwres_uint32_t   -addrtype, lwres_uint32_t addrtype,
 lwres_uint16_t   -addrlen, lwres_uint16_t addrlen,
 const unsigned char *  -addr, const unsigned char *addr,
 lwres_gnbaresponse_t **  -structp);lwres_gnbaresponse_t **structp);
+
 
-
-

DESCRIPTION

+
+

DESCRIPTION

lwres_string_parse() retrieves a DNS-encoded string starting the current pointer of lightweight resolver buffer b: i.e. @@ -209,8 +184,8 @@ typedef struct { *structp.

-
-

RETURN VALUES

+
+

RETURN VALUES

Successful calls to lwres_string_parse() @@ -247,8 +222,8 @@ typedef struct { small.

-
-

SEE ALSO

+
+

SEE ALSO

lwres_buffer(3), lwres_gabn(3). diff --git a/contrib/bind9/make/rules.in b/contrib/bind9/make/rules.in index 2a412f6c0..d5703e7a5 100644 --- a/contrib/bind9/make/rules.in +++ b/contrib/bind9/make/rules.in @@ -1,4 +1,4 @@ -# Copyright (C) 2004-2009, 2011, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") +# Copyright (C) 2004-2009, 2011, 2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC") # Copyright (C) 1998-2003 Internet Software Consortium. # # Permission to use, copy, modify, and/or distribute this software for any @@ -311,9 +311,11 @@ INSTALL_LIBRARY = @INSTALL_LIBRARY@ ### XSLTPROC = @XSLTPROC@ --novalid --xinclude --nonet +XMLLINT = @XMLLINT@ PERL = @PERL@ LATEX = @LATEX@ PDFLATEX = @PDFLATEX@ +DBLATEX = @DBLATEX@ W3M = @W3M@ ### diff --git a/contrib/bind9/version b/contrib/bind9/version index ab704e33e..1aebb0ce7 100644 --- a/contrib/bind9/version +++ b/contrib/bind9/version @@ -5,7 +5,7 @@ PRODUCT=BIND DESCRIPTION="(Extended Support Version)" MAJORVER=9 MINORVER=9 -PATCHVER=8 +PATCHVER=9 RELEASETYPE=-P -RELEASEVER=4 +RELEASEVER=3 EXTENSIONS= diff --git a/lib/bind/dns/code.h b/lib/bind/dns/code.h index e75254010..be4261bd4 100644 --- a/lib/bind/dns/code.h +++ b/lib/bind/dns/code.h @@ -72,6 +72,7 @@ #include "rdata/generic/cert_37.c" #include "rdata/in_1/a6_38.c" #include "rdata/generic/dname_39.c" +#include "rdata/generic/sink_40.c" #include "rdata/generic/opt_41.c" #include "rdata/in_1/apl_42.c" #include "rdata/generic/ds_43.c" @@ -84,10 +85,15 @@ #include "rdata/generic/nsec3_50.c" #include "rdata/generic/nsec3param_51.c" #include "rdata/generic/tlsa_52.c" +#include "rdata/generic/smimea_53.c" #include "rdata/generic/hip_55.c" +#include "rdata/generic/ninfo_56.c" +#include "rdata/generic/rkey_57.c" +#include "rdata/generic/talink_58.c" #include "rdata/generic/cds_59.c" #include "rdata/generic/cdnskey_60.c" #include "rdata/generic/openpgpkey_61.c" +#include "rdata/generic/csync_62.c" #include "rdata/generic/spf_99.c" #include "rdata/generic/unspec_103.c" #include "rdata/generic/nid_104.c" @@ -100,6 +106,8 @@ #include "rdata/any_255/tsig_250.c" #include "rdata/generic/uri_256.c" #include "rdata/generic/caa_257.c" +#include "rdata/generic/avc_258.c" +#include "rdata/generic/ta_32768.c" #include "rdata/generic/dlv_32769.c" #include "rdata/generic/keydata_65533.c" @@ -181,6 +189,7 @@ } \ break; \ case 39: result = fromtext_dname(rdclass, type, lexer, origin, options, target, callbacks); break; \ + case 40: result = fromtext_sink(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 41: result = fromtext_opt(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 42: switch (rdclass) { \ case 1: result = fromtext_in_apl(rdclass, type, lexer, origin, options, target, callbacks); break; \ @@ -201,10 +210,15 @@ case 50: result = fromtext_nsec3(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 51: result = fromtext_nsec3param(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 52: result = fromtext_tlsa(rdclass, type, lexer, origin, options, target, callbacks); break; \ + case 53: result = fromtext_smimea(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 55: result = fromtext_hip(rdclass, type, lexer, origin, options, target, callbacks); break; \ + case 56: result = fromtext_ninfo(rdclass, type, lexer, origin, options, target, callbacks); break; \ + case 57: result = fromtext_rkey(rdclass, type, lexer, origin, options, target, callbacks); break; \ + case 58: result = fromtext_talink(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 59: result = fromtext_cds(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 60: result = fromtext_cdnskey(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 61: result = fromtext_openpgpkey(rdclass, type, lexer, origin, options, target, callbacks); break; \ + case 62: result = fromtext_csync(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 99: result = fromtext_spf(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 103: result = fromtext_unspec(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 104: result = fromtext_nid(rdclass, type, lexer, origin, options, target, callbacks); break; \ @@ -221,6 +235,8 @@ break; \ case 256: result = fromtext_uri(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 257: result = fromtext_caa(rdclass, type, lexer, origin, options, target, callbacks); break; \ + case 258: result = fromtext_avc(rdclass, type, lexer, origin, options, target, callbacks); break; \ + case 32768: result = fromtext_ta(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 32769: result = fromtext_dlv(rdclass, type, lexer, origin, options, target, callbacks); break; \ case 65533: result = fromtext_keydata(rdclass, type, lexer, origin, options, target, callbacks); break; \ default: result = DNS_R_UNKNOWN; break; \ @@ -302,6 +318,7 @@ } \ break; \ case 39: result = totext_dname(rdata, tctx, target); break; \ + case 40: result = totext_sink(rdata, tctx, target); break; \ case 41: result = totext_opt(rdata, tctx, target); break; \ case 42: switch (rdata->rdclass) { \ case 1: result = totext_in_apl(rdata, tctx, target); break; \ @@ -322,10 +339,15 @@ case 50: result = totext_nsec3(rdata, tctx, target); break; \ case 51: result = totext_nsec3param(rdata, tctx, target); break; \ case 52: result = totext_tlsa(rdata, tctx, target); break; \ + case 53: result = totext_smimea(rdata, tctx, target); break; \ case 55: result = totext_hip(rdata, tctx, target); break; \ + case 56: result = totext_ninfo(rdata, tctx, target); break; \ + case 57: result = totext_rkey(rdata, tctx, target); break; \ + case 58: result = totext_talink(rdata, tctx, target); break; \ case 59: result = totext_cds(rdata, tctx, target); break; \ case 60: result = totext_cdnskey(rdata, tctx, target); break; \ case 61: result = totext_openpgpkey(rdata, tctx, target); break; \ + case 62: result = totext_csync(rdata, tctx, target); break; \ case 99: result = totext_spf(rdata, tctx, target); break; \ case 103: result = totext_unspec(rdata, tctx, target); break; \ case 104: result = totext_nid(rdata, tctx, target); break; \ @@ -342,6 +364,8 @@ break; \ case 256: result = totext_uri(rdata, tctx, target); break; \ case 257: result = totext_caa(rdata, tctx, target); break; \ + case 258: result = totext_avc(rdata, tctx, target); break; \ + case 32768: result = totext_ta(rdata, tctx, target); break; \ case 32769: result = totext_dlv(rdata, tctx, target); break; \ case 65533: result = totext_keydata(rdata, tctx, target); break; \ default: use_default = ISC_TRUE; break; \ @@ -423,6 +447,7 @@ } \ break; \ case 39: result = fromwire_dname(rdclass, type, source, dctx, options, target); break; \ + case 40: result = fromwire_sink(rdclass, type, source, dctx, options, target); break; \ case 41: result = fromwire_opt(rdclass, type, source, dctx, options, target); break; \ case 42: switch (rdclass) { \ case 1: result = fromwire_in_apl(rdclass, type, source, dctx, options, target); break; \ @@ -443,10 +468,15 @@ case 50: result = fromwire_nsec3(rdclass, type, source, dctx, options, target); break; \ case 51: result = fromwire_nsec3param(rdclass, type, source, dctx, options, target); break; \ case 52: result = fromwire_tlsa(rdclass, type, source, dctx, options, target); break; \ + case 53: result = fromwire_smimea(rdclass, type, source, dctx, options, target); break; \ case 55: result = fromwire_hip(rdclass, type, source, dctx, options, target); break; \ + case 56: result = fromwire_ninfo(rdclass, type, source, dctx, options, target); break; \ + case 57: result = fromwire_rkey(rdclass, type, source, dctx, options, target); break; \ + case 58: result = fromwire_talink(rdclass, type, source, dctx, options, target); break; \ case 59: result = fromwire_cds(rdclass, type, source, dctx, options, target); break; \ case 60: result = fromwire_cdnskey(rdclass, type, source, dctx, options, target); break; \ case 61: result = fromwire_openpgpkey(rdclass, type, source, dctx, options, target); break; \ + case 62: result = fromwire_csync(rdclass, type, source, dctx, options, target); break; \ case 99: result = fromwire_spf(rdclass, type, source, dctx, options, target); break; \ case 103: result = fromwire_unspec(rdclass, type, source, dctx, options, target); break; \ case 104: result = fromwire_nid(rdclass, type, source, dctx, options, target); break; \ @@ -463,6 +493,8 @@ break; \ case 256: result = fromwire_uri(rdclass, type, source, dctx, options, target); break; \ case 257: result = fromwire_caa(rdclass, type, source, dctx, options, target); break; \ + case 258: result = fromwire_avc(rdclass, type, source, dctx, options, target); break; \ + case 32768: result = fromwire_ta(rdclass, type, source, dctx, options, target); break; \ case 32769: result = fromwire_dlv(rdclass, type, source, dctx, options, target); break; \ case 65533: result = fromwire_keydata(rdclass, type, source, dctx, options, target); break; \ default: use_default = ISC_TRUE; break; \ @@ -544,6 +576,7 @@ } \ break; \ case 39: result = towire_dname(rdata, cctx, target); break; \ + case 40: result = towire_sink(rdata, cctx, target); break; \ case 41: result = towire_opt(rdata, cctx, target); break; \ case 42: switch (rdata->rdclass) { \ case 1: result = towire_in_apl(rdata, cctx, target); break; \ @@ -564,10 +597,15 @@ case 50: result = towire_nsec3(rdata, cctx, target); break; \ case 51: result = towire_nsec3param(rdata, cctx, target); break; \ case 52: result = towire_tlsa(rdata, cctx, target); break; \ + case 53: result = towire_smimea(rdata, cctx, target); break; \ case 55: result = towire_hip(rdata, cctx, target); break; \ + case 56: result = towire_ninfo(rdata, cctx, target); break; \ + case 57: result = towire_rkey(rdata, cctx, target); break; \ + case 58: result = towire_talink(rdata, cctx, target); break; \ case 59: result = towire_cds(rdata, cctx, target); break; \ case 60: result = towire_cdnskey(rdata, cctx, target); break; \ case 61: result = towire_openpgpkey(rdata, cctx, target); break; \ + case 62: result = towire_csync(rdata, cctx, target); break; \ case 99: result = towire_spf(rdata, cctx, target); break; \ case 103: result = towire_unspec(rdata, cctx, target); break; \ case 104: result = towire_nid(rdata, cctx, target); break; \ @@ -584,6 +622,8 @@ break; \ case 256: result = towire_uri(rdata, cctx, target); break; \ case 257: result = towire_caa(rdata, cctx, target); break; \ + case 258: result = towire_avc(rdata, cctx, target); break; \ + case 32768: result = towire_ta(rdata, cctx, target); break; \ case 32769: result = towire_dlv(rdata, cctx, target); break; \ case 65533: result = towire_keydata(rdata, cctx, target); break; \ default: use_default = ISC_TRUE; break; \ @@ -665,6 +705,7 @@ } \ break; \ case 39: result = compare_dname(rdata1, rdata2); break; \ + case 40: result = compare_sink(rdata1, rdata2); break; \ case 41: result = compare_opt(rdata1, rdata2); break; \ case 42: switch (rdata1->rdclass) { \ case 1: result = compare_in_apl(rdata1, rdata2); break; \ @@ -685,10 +726,15 @@ case 50: result = compare_nsec3(rdata1, rdata2); break; \ case 51: result = compare_nsec3param(rdata1, rdata2); break; \ case 52: result = compare_tlsa(rdata1, rdata2); break; \ + case 53: result = compare_smimea(rdata1, rdata2); break; \ case 55: result = compare_hip(rdata1, rdata2); break; \ + case 56: result = compare_ninfo(rdata1, rdata2); break; \ + case 57: result = compare_rkey(rdata1, rdata2); break; \ + case 58: result = compare_talink(rdata1, rdata2); break; \ case 59: result = compare_cds(rdata1, rdata2); break; \ case 60: result = compare_cdnskey(rdata1, rdata2); break; \ case 61: result = compare_openpgpkey(rdata1, rdata2); break; \ + case 62: result = compare_csync(rdata1, rdata2); break; \ case 99: result = compare_spf(rdata1, rdata2); break; \ case 103: result = compare_unspec(rdata1, rdata2); break; \ case 104: result = compare_nid(rdata1, rdata2); break; \ @@ -705,6 +751,8 @@ break; \ case 256: result = compare_uri(rdata1, rdata2); break; \ case 257: result = compare_caa(rdata1, rdata2); break; \ + case 258: result = compare_avc(rdata1, rdata2); break; \ + case 32768: result = compare_ta(rdata1, rdata2); break; \ case 32769: result = compare_dlv(rdata1, rdata2); break; \ case 65533: result = compare_keydata(rdata1, rdata2); break; \ default: use_default = ISC_TRUE; break; \ @@ -786,6 +834,7 @@ } \ break; \ case 39: result = casecompare_dname(rdata1, rdata2); break; \ + case 40: result = casecompare_sink(rdata1, rdata2); break; \ case 41: result = casecompare_opt(rdata1, rdata2); break; \ case 42: switch (rdata1->rdclass) { \ case 1: result = casecompare_in_apl(rdata1, rdata2); break; \ @@ -806,10 +855,15 @@ case 50: result = casecompare_nsec3(rdata1, rdata2); break; \ case 51: result = casecompare_nsec3param(rdata1, rdata2); break; \ case 52: result = casecompare_tlsa(rdata1, rdata2); break; \ + case 53: result = casecompare_smimea(rdata1, rdata2); break; \ case 55: result = casecompare_hip(rdata1, rdata2); break; \ + case 56: result = casecompare_ninfo(rdata1, rdata2); break; \ + case 57: result = casecompare_rkey(rdata1, rdata2); break; \ + case 58: result = casecompare_talink(rdata1, rdata2); break; \ case 59: result = casecompare_cds(rdata1, rdata2); break; \ case 60: result = casecompare_cdnskey(rdata1, rdata2); break; \ case 61: result = casecompare_openpgpkey(rdata1, rdata2); break; \ + case 62: result = casecompare_csync(rdata1, rdata2); break; \ case 99: result = casecompare_spf(rdata1, rdata2); break; \ case 103: result = casecompare_unspec(rdata1, rdata2); break; \ case 104: result = casecompare_nid(rdata1, rdata2); break; \ @@ -826,6 +880,8 @@ break; \ case 256: result = casecompare_uri(rdata1, rdata2); break; \ case 257: result = casecompare_caa(rdata1, rdata2); break; \ + case 258: result = casecompare_avc(rdata1, rdata2); break; \ + case 32768: result = casecompare_ta(rdata1, rdata2); break; \ case 32769: result = casecompare_dlv(rdata1, rdata2); break; \ case 65533: result = casecompare_keydata(rdata1, rdata2); break; \ default: use_default = ISC_TRUE; break; \ @@ -907,6 +963,7 @@ } \ break; \ case 39: result = fromstruct_dname(rdclass, type, source, target); break; \ + case 40: result = fromstruct_sink(rdclass, type, source, target); break; \ case 41: result = fromstruct_opt(rdclass, type, source, target); break; \ case 42: switch (rdclass) { \ case 1: result = fromstruct_in_apl(rdclass, type, source, target); break; \ @@ -927,10 +984,15 @@ case 50: result = fromstruct_nsec3(rdclass, type, source, target); break; \ case 51: result = fromstruct_nsec3param(rdclass, type, source, target); break; \ case 52: result = fromstruct_tlsa(rdclass, type, source, target); break; \ + case 53: result = fromstruct_smimea(rdclass, type, source, target); break; \ case 55: result = fromstruct_hip(rdclass, type, source, target); break; \ + case 56: result = fromstruct_ninfo(rdclass, type, source, target); break; \ + case 57: result = fromstruct_rkey(rdclass, type, source, target); break; \ + case 58: result = fromstruct_talink(rdclass, type, source, target); break; \ case 59: result = fromstruct_cds(rdclass, type, source, target); break; \ case 60: result = fromstruct_cdnskey(rdclass, type, source, target); break; \ case 61: result = fromstruct_openpgpkey(rdclass, type, source, target); break; \ + case 62: result = fromstruct_csync(rdclass, type, source, target); break; \ case 99: result = fromstruct_spf(rdclass, type, source, target); break; \ case 103: result = fromstruct_unspec(rdclass, type, source, target); break; \ case 104: result = fromstruct_nid(rdclass, type, source, target); break; \ @@ -947,6 +1009,8 @@ break; \ case 256: result = fromstruct_uri(rdclass, type, source, target); break; \ case 257: result = fromstruct_caa(rdclass, type, source, target); break; \ + case 258: result = fromstruct_avc(rdclass, type, source, target); break; \ + case 32768: result = fromstruct_ta(rdclass, type, source, target); break; \ case 32769: result = fromstruct_dlv(rdclass, type, source, target); break; \ case 65533: result = fromstruct_keydata(rdclass, type, source, target); break; \ default: use_default = ISC_TRUE; break; \ @@ -1028,6 +1092,7 @@ } \ break; \ case 39: result = tostruct_dname(rdata, target, mctx); break; \ + case 40: result = tostruct_sink(rdata, target, mctx); break; \ case 41: result = tostruct_opt(rdata, target, mctx); break; \ case 42: switch (rdata->rdclass) { \ case 1: result = tostruct_in_apl(rdata, target, mctx); break; \ @@ -1048,10 +1113,15 @@ case 50: result = tostruct_nsec3(rdata, target, mctx); break; \ case 51: result = tostruct_nsec3param(rdata, target, mctx); break; \ case 52: result = tostruct_tlsa(rdata, target, mctx); break; \ + case 53: result = tostruct_smimea(rdata, target, mctx); break; \ case 55: result = tostruct_hip(rdata, target, mctx); break; \ + case 56: result = tostruct_ninfo(rdata, target, mctx); break; \ + case 57: result = tostruct_rkey(rdata, target, mctx); break; \ + case 58: result = tostruct_talink(rdata, target, mctx); break; \ case 59: result = tostruct_cds(rdata, target, mctx); break; \ case 60: result = tostruct_cdnskey(rdata, target, mctx); break; \ case 61: result = tostruct_openpgpkey(rdata, target, mctx); break; \ + case 62: result = tostruct_csync(rdata, target, mctx); break; \ case 99: result = tostruct_spf(rdata, target, mctx); break; \ case 103: result = tostruct_unspec(rdata, target, mctx); break; \ case 104: result = tostruct_nid(rdata, target, mctx); break; \ @@ -1068,6 +1138,8 @@ break; \ case 256: result = tostruct_uri(rdata, target, mctx); break; \ case 257: result = tostruct_caa(rdata, target, mctx); break; \ + case 258: result = tostruct_avc(rdata, target, mctx); break; \ + case 32768: result = tostruct_ta(rdata, target, mctx); break; \ case 32769: result = tostruct_dlv(rdata, target, mctx); break; \ case 65533: result = tostruct_keydata(rdata, target, mctx); break; \ default: use_default = ISC_TRUE; break; \ @@ -1149,6 +1221,7 @@ } \ break; \ case 39: freestruct_dname(source); break; \ + case 40: freestruct_sink(source); break; \ case 41: freestruct_opt(source); break; \ case 42: switch (common->rdclass) { \ case 1: freestruct_in_apl(source); break; \ @@ -1169,10 +1242,15 @@ case 50: freestruct_nsec3(source); break; \ case 51: freestruct_nsec3param(source); break; \ case 52: freestruct_tlsa(source); break; \ + case 53: freestruct_smimea(source); break; \ case 55: freestruct_hip(source); break; \ + case 56: freestruct_ninfo(source); break; \ + case 57: freestruct_rkey(source); break; \ + case 58: freestruct_talink(source); break; \ case 59: freestruct_cds(source); break; \ case 60: freestruct_cdnskey(source); break; \ case 61: freestruct_openpgpkey(source); break; \ + case 62: freestruct_csync(source); break; \ case 99: freestruct_spf(source); break; \ case 103: freestruct_unspec(source); break; \ case 104: freestruct_nid(source); break; \ @@ -1189,6 +1267,8 @@ break; \ case 256: freestruct_uri(source); break; \ case 257: freestruct_caa(source); break; \ + case 258: freestruct_avc(source); break; \ + case 32768: freestruct_ta(source); break; \ case 32769: freestruct_dlv(source); break; \ case 65533: freestruct_keydata(source); break; \ default: break; \ @@ -1270,6 +1350,7 @@ } \ break; \ case 39: result = additionaldata_dname(rdata, add, arg); break; \ + case 40: result = additionaldata_sink(rdata, add, arg); break; \ case 41: result = additionaldata_opt(rdata, add, arg); break; \ case 42: switch (rdata->rdclass) { \ case 1: result = additionaldata_in_apl(rdata, add, arg); break; \ @@ -1290,10 +1371,15 @@ case 50: result = additionaldata_nsec3(rdata, add, arg); break; \ case 51: result = additionaldata_nsec3param(rdata, add, arg); break; \ case 52: result = additionaldata_tlsa(rdata, add, arg); break; \ + case 53: result = additionaldata_smimea(rdata, add, arg); break; \ case 55: result = additionaldata_hip(rdata, add, arg); break; \ + case 56: result = additionaldata_ninfo(rdata, add, arg); break; \ + case 57: result = additionaldata_rkey(rdata, add, arg); break; \ + case 58: result = additionaldata_talink(rdata, add, arg); break; \ case 59: result = additionaldata_cds(rdata, add, arg); break; \ case 60: result = additionaldata_cdnskey(rdata, add, arg); break; \ case 61: result = additionaldata_openpgpkey(rdata, add, arg); break; \ + case 62: result = additionaldata_csync(rdata, add, arg); break; \ case 99: result = additionaldata_spf(rdata, add, arg); break; \ case 103: result = additionaldata_unspec(rdata, add, arg); break; \ case 104: result = additionaldata_nid(rdata, add, arg); break; \ @@ -1310,6 +1396,8 @@ break; \ case 256: result = additionaldata_uri(rdata, add, arg); break; \ case 257: result = additionaldata_caa(rdata, add, arg); break; \ + case 258: result = additionaldata_avc(rdata, add, arg); break; \ + case 32768: result = additionaldata_ta(rdata, add, arg); break; \ case 32769: result = additionaldata_dlv(rdata, add, arg); break; \ case 65533: result = additionaldata_keydata(rdata, add, arg); break; \ default: use_default = ISC_TRUE; break; \ @@ -1391,6 +1479,7 @@ } \ break; \ case 39: result = digest_dname(rdata, digest, arg); break; \ + case 40: result = digest_sink(rdata, digest, arg); break; \ case 41: result = digest_opt(rdata, digest, arg); break; \ case 42: switch (rdata->rdclass) { \ case 1: result = digest_in_apl(rdata, digest, arg); break; \ @@ -1411,10 +1500,15 @@ case 50: result = digest_nsec3(rdata, digest, arg); break; \ case 51: result = digest_nsec3param(rdata, digest, arg); break; \ case 52: result = digest_tlsa(rdata, digest, arg); break; \ + case 53: result = digest_smimea(rdata, digest, arg); break; \ case 55: result = digest_hip(rdata, digest, arg); break; \ + case 56: result = digest_ninfo(rdata, digest, arg); break; \ + case 57: result = digest_rkey(rdata, digest, arg); break; \ + case 58: result = digest_talink(rdata, digest, arg); break; \ case 59: result = digest_cds(rdata, digest, arg); break; \ case 60: result = digest_cdnskey(rdata, digest, arg); break; \ case 61: result = digest_openpgpkey(rdata, digest, arg); break; \ + case 62: result = digest_csync(rdata, digest, arg); break; \ case 99: result = digest_spf(rdata, digest, arg); break; \ case 103: result = digest_unspec(rdata, digest, arg); break; \ case 104: result = digest_nid(rdata, digest, arg); break; \ @@ -1431,6 +1525,8 @@ break; \ case 256: result = digest_uri(rdata, digest, arg); break; \ case 257: result = digest_caa(rdata, digest, arg); break; \ + case 258: result = digest_avc(rdata, digest, arg); break; \ + case 32768: result = digest_ta(rdata, digest, arg); break; \ case 32769: result = digest_dlv(rdata, digest, arg); break; \ case 65533: result = digest_keydata(rdata, digest, arg); break; \ default: use_default = ISC_TRUE; break; \ @@ -1512,6 +1608,7 @@ } \ break; \ case 39: result = checkowner_dname(name, rdclass, type, wildcard); break; \ + case 40: result = checkowner_sink(name, rdclass, type, wildcard); break; \ case 41: result = checkowner_opt(name, rdclass, type, wildcard); break; \ case 42: switch (rdclass) { \ case 1: result = checkowner_in_apl(name, rdclass, type, wildcard); break; \ @@ -1532,10 +1629,15 @@ case 50: result = checkowner_nsec3(name, rdclass, type, wildcard); break; \ case 51: result = checkowner_nsec3param(name, rdclass, type, wildcard); break; \ case 52: result = checkowner_tlsa(name, rdclass, type, wildcard); break; \ + case 53: result = checkowner_smimea(name, rdclass, type, wildcard); break; \ case 55: result = checkowner_hip(name, rdclass, type, wildcard); break; \ + case 56: result = checkowner_ninfo(name, rdclass, type, wildcard); break; \ + case 57: result = checkowner_rkey(name, rdclass, type, wildcard); break; \ + case 58: result = checkowner_talink(name, rdclass, type, wildcard); break; \ case 59: result = checkowner_cds(name, rdclass, type, wildcard); break; \ case 60: result = checkowner_cdnskey(name, rdclass, type, wildcard); break; \ case 61: result = checkowner_openpgpkey(name, rdclass, type, wildcard); break; \ + case 62: result = checkowner_csync(name, rdclass, type, wildcard); break; \ case 99: result = checkowner_spf(name, rdclass, type, wildcard); break; \ case 103: result = checkowner_unspec(name, rdclass, type, wildcard); break; \ case 104: result = checkowner_nid(name, rdclass, type, wildcard); break; \ @@ -1552,6 +1654,8 @@ break; \ case 256: result = checkowner_uri(name, rdclass, type, wildcard); break; \ case 257: result = checkowner_caa(name, rdclass, type, wildcard); break; \ + case 258: result = checkowner_avc(name, rdclass, type, wildcard); break; \ + case 32768: result = checkowner_ta(name, rdclass, type, wildcard); break; \ case 32769: result = checkowner_dlv(name, rdclass, type, wildcard); break; \ case 65533: result = checkowner_keydata(name, rdclass, type, wildcard); break; \ default: result = ISC_TRUE; break; \ @@ -1633,6 +1737,7 @@ } \ break; \ case 39: result = checknames_dname(rdata, owner, bad); break; \ + case 40: result = checknames_sink(rdata, owner, bad); break; \ case 41: result = checknames_opt(rdata, owner, bad); break; \ case 42: switch (rdata->rdclass) { \ case 1: result = checknames_in_apl(rdata, owner, bad); break; \ @@ -1653,10 +1758,15 @@ case 50: result = checknames_nsec3(rdata, owner, bad); break; \ case 51: result = checknames_nsec3param(rdata, owner, bad); break; \ case 52: result = checknames_tlsa(rdata, owner, bad); break; \ + case 53: result = checknames_smimea(rdata, owner, bad); break; \ case 55: result = checknames_hip(rdata, owner, bad); break; \ + case 56: result = checknames_ninfo(rdata, owner, bad); break; \ + case 57: result = checknames_rkey(rdata, owner, bad); break; \ + case 58: result = checknames_talink(rdata, owner, bad); break; \ case 59: result = checknames_cds(rdata, owner, bad); break; \ case 60: result = checknames_cdnskey(rdata, owner, bad); break; \ case 61: result = checknames_openpgpkey(rdata, owner, bad); break; \ + case 62: result = checknames_csync(rdata, owner, bad); break; \ case 99: result = checknames_spf(rdata, owner, bad); break; \ case 103: result = checknames_unspec(rdata, owner, bad); break; \ case 104: result = checknames_nid(rdata, owner, bad); break; \ @@ -1673,6 +1783,8 @@ break; \ case 256: result = checknames_uri(rdata, owner, bad); break; \ case 257: result = checknames_caa(rdata, owner, bad); break; \ + case 258: result = checknames_avc(rdata, owner, bad); break; \ + case 32768: result = checknames_ta(rdata, owner, bad); break; \ case 32769: result = checknames_dlv(rdata, owner, bad); break; \ case 65533: result = checknames_keydata(rdata, owner, bad); break; \ default: result = ISC_TRUE; break; \ @@ -1711,6 +1823,7 @@ break; \ case 182: \ RDATATYPE_COMPARE("soa", 6, _typename, _length, _typep); \ + RDATATYPE_COMPARE("ta", 32768, _typename, _length, _typep); \ break; \ case 126: \ RDATATYPE_COMPARE("mb", 7, _typename, _length, _typep); \ @@ -1769,6 +1882,7 @@ break; \ case 254: \ RDATATYPE_COMPARE("key", 25, _typename, _length, _typep); \ + RDATATYPE_COMPARE("talink", 58, _typename, _length, _typep); \ break; \ case 112: \ RDATATYPE_COMPARE("px", 26, _typename, _length, _typep); \ @@ -1797,6 +1911,7 @@ break; \ case 172: \ RDATATYPE_COMPARE("cert", 37, _typename, _length, _typep); \ + RDATATYPE_COMPARE("avc", 258, _typename, _length, _typep); \ break; \ case 226: \ RDATATYPE_COMPARE("a6", 38, _typename, _length, _typep); \ @@ -1804,6 +1919,9 @@ case 109: \ RDATATYPE_COMPARE("dname", 39, _typename, _length, _typep); \ break; \ + case 189: \ + RDATATYPE_COMPARE("sink", 40, _typename, _length, _typep); \ + break; \ case 168: \ RDATATYPE_COMPARE("opt", 41, _typename, _length, _typep); \ break; \ @@ -1841,12 +1959,25 @@ case 120: \ RDATATYPE_COMPARE("tlsa", 52, _typename, _length, _typep); \ break; \ + case 217: \ + RDATATYPE_COMPARE("smimea", 53, _typename, _length, _typep); \ + break; \ case 208: \ RDATATYPE_COMPARE("hip", 55, _typename, _length, _typep); \ break; \ + case 221: \ + RDATATYPE_COMPARE("ninfo", 56, _typename, _length, _typep); \ + break; \ + case 198: \ + RDATATYPE_COMPARE("rkey", 57, _typename, _length, _typep); \ + break; \ case 49: \ RDATATYPE_COMPARE("openpgpkey", 61, _typename, _length, _typep); \ break; \ + case 56: \ + RDATATYPE_COMPARE("csync", 62, _typename, _length, _typep); \ + RDATATYPE_COMPARE("uri", 256, _typename, _length, _typep); \ + break; \ case 230: \ RDATATYPE_COMPARE("uinfo", 100, _typename, _length, _typep); \ break; \ @@ -1890,9 +2021,6 @@ case 68: \ RDATATYPE_COMPARE("any", 255, _typename, _length, _typep); \ break; \ - case 56: \ - RDATATYPE_COMPARE("uri", 256, _typename, _length, _typep); \ - break; \ case 166: \ RDATATYPE_COMPARE("caa", 257, _typename, _length, _typep); \ break; \ @@ -1939,6 +2067,7 @@ case 37: return (RRTYPE_CERT_ATTRIBUTES); \ case 38: return (RRTYPE_A6_ATTRIBUTES); \ case 39: return (RRTYPE_DNAME_ATTRIBUTES); \ + case 40: return (RRTYPE_SINK_ATTRIBUTES); \ case 41: return (RRTYPE_OPT_ATTRIBUTES); \ case 42: return (RRTYPE_APL_ATTRIBUTES); \ case 43: return (RRTYPE_DS_ATTRIBUTES); \ @@ -1951,10 +2080,15 @@ case 50: return (RRTYPE_NSEC3_ATTRIBUTES); \ case 51: return (RRTYPE_NSEC3PARAM_ATTRIBUTES); \ case 52: return (RRTYPE_TLSA_ATTRIBUTES); \ + case 53: return (RRTYPE_SMIMEA_ATTRIBUTES); \ case 55: return (RRTYPE_HIP_ATTRIBUTES); \ + case 56: return (RRTYPE_NINFO_ATTRIBUTES); \ + case 57: return (RRTYPE_RKEY_ATTRIBUTES); \ + case 58: return (RRTYPE_TALINK_ATTRIBUTES); \ case 59: return (RRTYPE_CDS_ATTRIBUTES); \ case 60: return (RRTYPE_CDNSKEY_ATTRIBUTES); \ case 61: return (RRTYPE_OPENPGPKEY_ATTRIBUTES); \ + case 62: return (RRTYPE_CSYNC_ATTRIBUTES); \ case 99: return (RRTYPE_SPF_ATTRIBUTES); \ case 100: return (DNS_RDATATYPEATTR_RESERVED); \ case 101: return (DNS_RDATATYPEATTR_RESERVED); \ @@ -1975,6 +2109,8 @@ case 255: return (DNS_RDATATYPEATTR_META | DNS_RDATATYPEATTR_QUESTIONONLY); \ case 256: return (RRTYPE_URI_ATTRIBUTES); \ case 257: return (RRTYPE_CAA_ATTRIBUTES); \ + case 258: return (RRTYPE_AVC_ATTRIBUTES); \ + case 32768: return (RRTYPE_TA_ATTRIBUTES); \ case 32769: return (RRTYPE_DLV_ATTRIBUTES); \ case 65533: return (RRTYPE_KEYDATA_ATTRIBUTES); \ } @@ -2020,6 +2156,7 @@ case 37: return (str_totext("CERT", target)); \ case 38: return (str_totext("A6", target)); \ case 39: return (str_totext("DNAME", target)); \ + case 40: return (str_totext("SINK", target)); \ case 41: return (str_totext("OPT", target)); \ case 42: return (str_totext("APL", target)); \ case 43: return (str_totext("DS", target)); \ @@ -2032,10 +2169,15 @@ case 50: return (str_totext("NSEC3", target)); \ case 51: return (str_totext("NSEC3PARAM", target)); \ case 52: return (str_totext("TLSA", target)); \ + case 53: return (str_totext("SMIMEA", target)); \ case 55: return (str_totext("HIP", target)); \ + case 56: return (str_totext("NINFO", target)); \ + case 57: return (str_totext("RKEY", target)); \ + case 58: return (str_totext("TALINK", target)); \ case 59: return (str_totext("CDS", target)); \ case 60: return (str_totext("CDNSKEY", target)); \ case 61: return (str_totext("OPENPGPKEY", target)); \ + case 62: return (str_totext("CSYNC", target)); \ case 99: return (str_totext("SPF", target)); \ case 100: return (str_totext("UINFO", target)); \ case 101: return (str_totext("UID", target)); \ @@ -2056,6 +2198,8 @@ case 255: return (str_totext("ANY", target)); \ case 256: return (str_totext("URI", target)); \ case 257: return (str_totext("CAA", target)); \ + case 258: return (str_totext("AVC", target)); \ + case 32768: return (str_totext("TA", target)); \ case 32769: return (str_totext("DLV", target)); \ } #endif /* DNS_CODE_H */ diff --git a/lib/bind/dns/dns/enumtype.h b/lib/bind/dns/dns/enumtype.h index 31d41d23e..19a113849 100644 --- a/lib/bind/dns/dns/enumtype.h +++ b/lib/bind/dns/dns/enumtype.h @@ -67,6 +67,7 @@ enum { dns_rdatatype_cert = 37, dns_rdatatype_a6 = 38, dns_rdatatype_dname = 39, + dns_rdatatype_sink = 40, dns_rdatatype_opt = 41, dns_rdatatype_apl = 42, dns_rdatatype_ds = 43, @@ -79,10 +80,15 @@ enum { dns_rdatatype_nsec3 = 50, dns_rdatatype_nsec3param = 51, dns_rdatatype_tlsa = 52, + dns_rdatatype_smimea = 53, dns_rdatatype_hip = 55, + dns_rdatatype_ninfo = 56, + dns_rdatatype_rkey = 57, + dns_rdatatype_talink = 58, dns_rdatatype_cds = 59, dns_rdatatype_cdnskey = 60, dns_rdatatype_openpgpkey = 61, + dns_rdatatype_csync = 62, dns_rdatatype_spf = 99, dns_rdatatype_unspec = 103, dns_rdatatype_nid = 104, @@ -95,6 +101,8 @@ enum { dns_rdatatype_tsig = 250, dns_rdatatype_uri = 256, dns_rdatatype_caa = 257, + dns_rdatatype_avc = 258, + dns_rdatatype_ta = 32768, dns_rdatatype_dlv = 32769, dns_rdatatype_keydata = 65533, dns_rdatatype_ixfr = 251, @@ -141,6 +149,7 @@ enum { #define dns_rdatatype_cert ((dns_rdatatype_t)dns_rdatatype_cert) #define dns_rdatatype_a6 ((dns_rdatatype_t)dns_rdatatype_a6) #define dns_rdatatype_dname ((dns_rdatatype_t)dns_rdatatype_dname) +#define dns_rdatatype_sink ((dns_rdatatype_t)dns_rdatatype_sink) #define dns_rdatatype_opt ((dns_rdatatype_t)dns_rdatatype_opt) #define dns_rdatatype_apl ((dns_rdatatype_t)dns_rdatatype_apl) #define dns_rdatatype_ds ((dns_rdatatype_t)dns_rdatatype_ds) @@ -153,10 +162,15 @@ enum { #define dns_rdatatype_nsec3 ((dns_rdatatype_t)dns_rdatatype_nsec3) #define dns_rdatatype_nsec3param ((dns_rdatatype_t)dns_rdatatype_nsec3param) #define dns_rdatatype_tlsa ((dns_rdatatype_t)dns_rdatatype_tlsa) +#define dns_rdatatype_smimea ((dns_rdatatype_t)dns_rdatatype_smimea) #define dns_rdatatype_hip ((dns_rdatatype_t)dns_rdatatype_hip) +#define dns_rdatatype_ninfo ((dns_rdatatype_t)dns_rdatatype_ninfo) +#define dns_rdatatype_rkey ((dns_rdatatype_t)dns_rdatatype_rkey) +#define dns_rdatatype_talink ((dns_rdatatype_t)dns_rdatatype_talink) #define dns_rdatatype_cds ((dns_rdatatype_t)dns_rdatatype_cds) #define dns_rdatatype_cdnskey ((dns_rdatatype_t)dns_rdatatype_cdnskey) #define dns_rdatatype_openpgpkey ((dns_rdatatype_t)dns_rdatatype_openpgpkey) +#define dns_rdatatype_csync ((dns_rdatatype_t)dns_rdatatype_csync) #define dns_rdatatype_spf ((dns_rdatatype_t)dns_rdatatype_spf) #define dns_rdatatype_unspec ((dns_rdatatype_t)dns_rdatatype_unspec) #define dns_rdatatype_nid ((dns_rdatatype_t)dns_rdatatype_nid) @@ -169,6 +183,8 @@ enum { #define dns_rdatatype_tsig ((dns_rdatatype_t)dns_rdatatype_tsig) #define dns_rdatatype_uri ((dns_rdatatype_t)dns_rdatatype_uri) #define dns_rdatatype_caa ((dns_rdatatype_t)dns_rdatatype_caa) +#define dns_rdatatype_avc ((dns_rdatatype_t)dns_rdatatype_avc) +#define dns_rdatatype_ta ((dns_rdatatype_t)dns_rdatatype_ta) #define dns_rdatatype_dlv ((dns_rdatatype_t)dns_rdatatype_dlv) #define dns_rdatatype_keydata ((dns_rdatatype_t)dns_rdatatype_keydata) #define dns_rdatatype_ixfr ((dns_rdatatype_t)dns_rdatatype_ixfr) diff --git a/lib/bind/dns/dns/rdatastruct.h b/lib/bind/dns/dns/rdatastruct.h index 80860e2e2..444422d98 100644 --- a/lib/bind/dns/dns/rdatastruct.h +++ b/lib/bind/dns/dns/rdatastruct.h @@ -925,7 +925,7 @@ typedef struct dns_rdata_sig_t { #endif /* GENERIC_SIG_24_H */ /* - * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2001 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -949,14 +949,14 @@ typedef struct dns_rdata_sig_t { /*! * \brief Per RFC2535 */ -typedef struct dns_rdata_key_t { - dns_rdatacommon_t common; - isc_mem_t * mctx; - isc_uint16_t flags; - isc_uint8_t protocol; - isc_uint8_t algorithm; - isc_uint16_t datalen; - unsigned char * data; +typedef struct dns_rdata_key { + dns_rdatacommon_t common; + isc_mem_t * mctx; + isc_uint16_t flags; + isc_uint8_t protocol; + isc_uint8_t algorithm; + isc_uint16_t datalen; + unsigned char * data; } dns_rdata_key_t; @@ -1350,6 +1350,36 @@ typedef struct dns_rdata_dname { } dns_rdata_dname_t; #endif /* GENERIC_DNAME_39_H */ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_SINK_40_H +#define GENERIC_SINK_40_H 1 + +typedef struct dns_rdata_sink_t { + dns_rdatacommon_t common; + isc_mem_t * mctx; + isc_uint8_t meaning; + isc_uint8_t coding; + isc_uint8_t subcoding; + isc_uint16_t datalen; + unsigned char * data; +} dns_rdata_sink_t; + +#endif /* GENERIC_SINK_40_H */ /* * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2001 Internet Software Consortium. @@ -1642,7 +1672,7 @@ typedef struct dns_rdata_nsec { #endif /* GENERIC_NSEC_47_H */ /* - * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2005, 2007, 2015 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -1661,21 +1691,11 @@ typedef struct dns_rdata_nsec { #ifndef GENERIC_DNSKEY_48_H #define GENERIC_DNSKEY_48_H 1 -/* $Id: dnskey_48.h,v 1.7 2007/06/19 23:47:17 tbox Exp $ */ - /*! - * \brief per RFC2535 */ - -typedef struct dns_rdata_dnskey { - dns_rdatacommon_t common; - isc_mem_t * mctx; - isc_uint16_t flags; - isc_uint8_t protocol; - isc_uint8_t algorithm; - isc_uint16_t datalen; - unsigned char * data; -} dns_rdata_dnskey_t; + * \brief per RFC2535 + */ +typedef struct dns_rdata_key dns_rdata_dnskey_t; #endif /* GENERIC_DNSKEY_48_H */ /* @@ -1899,6 +1919,28 @@ typedef struct dns_rdata_tlsa { } dns_rdata_tlsa_t; #endif /* GENERIC_TLSA_52_H */ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_SMIMEA_53_H +#define GENERIC_SMIMEA_53_H 1 + +typedef struct dns_rdata_tlsa dns_rdata_smimea_t; + +#endif /* GENERIC_SMIMEA_53_H */ /* * Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC") * @@ -1947,7 +1989,97 @@ dns_rdata_hip_current(dns_rdata_hip_t *, dns_name_t *); #endif /* GENERIC_HIP_5_H */ /* - * Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* */ +#ifndef GENERIC_NINFO_56_H +#define GENERIC_NINFO_56_H 1 + +typedef struct dns_rdata_txt_string dns_rdata_ninfo_string_t; + +typedef struct dns_rdata_txt dns_rdata_ninfo_t; + +/* + * ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS are already done + * via rdatastructpre.h and rdatastructsuf.h. + */ + +isc_result_t +dns_rdata_ninfo_first(dns_rdata_ninfo_t *); + +isc_result_t +dns_rdata_ninfo_next(dns_rdata_ninfo_t *); + +isc_result_t +dns_rdata_ninfo_current(dns_rdata_ninfo_t *, dns_rdata_ninfo_string_t *); + +#endif /* GENERIC_NINFO_16_H */ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_RKEY_57_H +#define GENERIC_RKEY_57_H 1 + +typedef struct dns_rdata_key dns_rdata_rkey_t; + +#endif /* GENERIC_RKEY_57_H */ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +/* http://www.iana.org/assignments/dns-parameters/TALINK/talink-completed-template */ + +#ifndef GENERIC_TALINK_58_H +#define GENERIC_TALINK_58_H 1 + +typedef struct dns_rdata_talink { + dns_rdatacommon_t common; + isc_mem_t *mctx; + dns_name_t prev; + dns_name_t next; +} dns_rdata_talink_t; + +#endif /* GENERIC_TALINK_58_H */ +/* + * Copyright (C) 2014, 2015 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -1966,19 +2098,11 @@ dns_rdata_hip_current(dns_rdata_hip_t *, dns_name_t *); #define GENERIC_CDS_59_H 1 /* CDS records have the same RDATA fields as DS records. */ -typedef struct dns_rdata_cds { - dns_rdatacommon_t common; - isc_mem_t *mctx; - isc_uint16_t key_tag; - isc_uint8_t algorithm; - isc_uint8_t digest_type; - isc_uint16_t length; - unsigned char *digest; -} dns_rdata_cds_t; +typedef struct dns_rdata_ds dns_rdata_cds_t; #endif /* GENERIC_CDS_59_H */ /* - * Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2014, 2015 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -1997,16 +2121,7 @@ typedef struct dns_rdata_cds { #define GENERIC_CDNSKEY_60_H 1 /* CDNSKEY records have the same RDATA fields as DNSKEY records. */ -typedef struct dns_rdata_cdnskey { - dns_rdatacommon_t common; - isc_mem_t * mctx; - isc_uint16_t flags; - isc_uint8_t protocol; - isc_uint8_t algorithm; - isc_uint16_t datalen; - unsigned char * data; -} dns_rdata_cdnskey_t; - +typedef struct dns_rdata_key dns_rdata_cdnskey_t; #endif /* GENERIC_CDNSKEY_60_H */ /* @@ -2036,6 +2151,39 @@ typedef struct dns_rdata_openpgpkey { } dns_rdata_openpgpkey_t; #endif /* GENERIC_OPENPGPKEY_61_H */ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_CSYNC_62_H +#define GENERIC_CSYNC_62_H 1 + +/*! + * \brief Per RFC 7477 + */ + +typedef struct dns_rdata_csync { + dns_rdatacommon_t common; + isc_mem_t *mctx; + isc_uint32_t serial; + isc_uint16_t flags; + unsigned char *typebits; + isc_uint16_t len; +} dns_rdata_csync_t; + +#endif /* GENERIC_CSYNC_62_H */ /* * Copyright (C) 2004, 2005, 2007, 2014 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1998-2001 Internet Software Consortium. @@ -2412,7 +2560,67 @@ typedef struct dns_rdata_caa { #endif /* GENERIC_CAA_257_H */ /* - * Copyright (C) 2004, 2006, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2016 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_AVC_258_H +#define GENERIC_AVC_258_H 1 + +typedef dns_rdata_txt_string_t dns_rdata_avc_string_t; + +typedef struct dns_rdata_avc { + dns_rdatacommon_t common; + isc_mem_t *mctx; + unsigned char *data; + isc_uint16_t length; + /* private */ + isc_uint16_t offset; +} dns_rdata_avc_t; + +/* + * ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS are already done + * via rdatastructpre.h and rdatastructsuf.h. + */ +#endif /* GENERIC_AVC_258_H */ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef GENERIC_TA_32768_H +#define GENERIC_TA_32768_H 1 + +/* + * TA records are identical to DS records. + */ +typedef struct dns_rdata_ds dns_rdata_ta_t; + +#endif /* GENERIC_TA_32768_H */ +/* + * Copyright (C) 2004, 2006, 2007, 2015 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -2433,15 +2641,7 @@ typedef struct dns_rdata_caa { #ifndef GENERIC_DLV_32769_H #define GENERIC_DLV_32769_H 1 -typedef struct dns_rdata_dlv { - dns_rdatacommon_t common; - isc_mem_t *mctx; - isc_uint16_t key_tag; - isc_uint8_t algorithm; - isc_uint8_t digest_type; - isc_uint16_t length; - unsigned char *digest; -} dns_rdata_dlv_t; +typedef struct dns_rdata_ds dns_rdata_dlv_t; #endif /* GENERIC_DLV_32769_H */ /* diff --git a/share/doc/bind9/Makefile b/share/doc/bind9/Makefile index f215fe3dd..0d206bb9a 100644 --- a/share/doc/bind9/Makefile +++ b/share/doc/bind9/Makefile @@ -10,23 +10,62 @@ NO_OBJ= FILESGROUPS= TOP ARM MISC TOP= CHANGES COPYRIGHT FAQ HISTORY README TOPDIR= ${DOCDIR}/bind9 -ARM= Bv9ARM.ch01.html Bv9ARM.ch02.html Bv9ARM.ch03.html \ - Bv9ARM.ch04.html Bv9ARM.ch05.html Bv9ARM.ch06.html \ - Bv9ARM.ch07.html Bv9ARM.ch08.html Bv9ARM.ch09.html \ - Bv9ARM.ch10.html Bv9ARM.html Bv9ARM.pdf \ - man.arpaname.html man.ddns-confgen.html man.dig.html \ - man.dnssec-dsfromkey.html man.dnssec-keyfromlabel.html \ - man.dnssec-keygen.html man.dnssec-revoke.html \ - man.dnssec-settime.html man.dnssec-signzone.html \ +ARM= Bv9ARM.ch01.html \ + Bv9ARM.ch02.html \ + Bv9ARM.ch03.html \ + Bv9ARM.ch04.html \ + Bv9ARM.ch05.html \ + Bv9ARM.ch06.html \ + Bv9ARM.ch07.html \ + Bv9ARM.ch08.html \ + Bv9ARM.ch09.html \ + Bv9ARM.ch10.html \ + Bv9ARM.ch11.html \ + Bv9ARM.ch12.html \ + Bv9ARM.ch13.html \ + Bv9ARM.html \ + Bv9ARM.pdf \ + isc-logo.pdf \ + man.arpaname.html \ + man.ddns-confgen.html \ + man.dig.html \ + man.dnssec-checkds.html \ + man.dnssec-coverage.html \ + man.dnssec-dsfromkey.html \ + man.dnssec-importkey.html \ + man.dnssec-keyfromlabel.html \ + man.dnssec-keygen.html \ + man.dnssec-revoke.html \ + man.dnssec-settime.html \ + man.dnssec-signzone.html \ man.dnssec-verify.html \ - man.genrandom.html man.host.html man.isc-hmac-fixup.html \ - man.named-checkconf.html man.named-checkzone.html \ - man.named-journalprint.html man.named.html \ - man.nsec3hash.html man.nsupdate.html \ - man.rndc-confgen.html man.rndc.conf.html man.rndc.html + man.genrandom.html \ + man.host.html \ + man.isc-hmac-fixup.html \ + man.lwresd.html \ + man.named-checkconf.html \ + man.named-checkzone.html \ + man.named-journalprint.html \ + man.named.conf.html \ + man.named.html \ + man.nsec3hash.html \ + man.nsupdate.html \ + man.rndc-confgen.html \ + man.rndc.conf.html \ + man.rndc.html \ + notes.html \ + notes.pdf ARMDIR= ${TOPDIR}/arm -MISC= dnssec format-options.pl ipv6 migration migration-4to9 \ - options rfc-compliance roadmap sdb sort-options.pl +MISC= dnssec \ + format-options.pl \ + ipv6 \ + migration \ + migration-4to9 \ + options \ + rfc-compliance \ + roadmap \ + sdb \ + sort-options.pl MISCDIR= ${TOPDIR}/misc .include -- 2.45.0